TryHackMe - LazyAdmin (Easy)
Last updated
Last updated
Gobuster finds a hidden directory /content that leaks CMS name. Searchsploit finds an exploit that leads us to a MySQL backup file, which leaks admin user's password hash. The password hash is just MD5 and we recover the plaintext password easily. Running Gobuster on /content , we find another hidden directory /content/as that has a login form. Using the leaked credential, we can access the admin panel.
In the admin panel, we find a file upload vulnerability and an easy file extension bypass. Upload php-reverse-shell.php5 and get a reverse shell as www-data.
In the privilege escalation phase, sudo -l finds that we are able to execute Perl as root. There is a backup script that executes /etc/copy.sh as root and /etc/copy.sh is world-writable. Store a Netcat reverse shell payload in it and run sudo perl on the backup script. Then we catch a reverse shell as root.
RHOST: 10.10.10.20
LHOST: 10.13.12.2
Gobuster finds a hidden directory /content:
Visit http://lazyadmin.thm/content/. The CMS used is SweetRice:
Searchsploit:
The "Backup Disclosure" PoC says that MySQL backup is at /inc/mysql_backup. In our case, it is at /content/inc/mysql_backup. Try to access this directory:
The manager user's password hash is leaked in this backup:
MD5 reverse hash lookup shows that the plaintext password is Password123, so the credential is manager:Password123. Now we need to find a login page to utilize this credential.
Run Gobuster on the directory /content and we find a new directory /content/as:
This directory has a login form:
Try the credential we just found and now we have access to the admin panel:
There is an arbitrary file upload exploit for SweetRice:
It suggests .php5 bypasses the filter:
Rename php-reverse-shell.php to php-reverse-shell.php5, go to "Media Center", and upload it:
Start a pwncat listener and catch a reverse shell as www-data:
sudo -l:
The file /home/itguy/backup.pl executes sh /etc/copy.sh as root and /etc/copy.sh is world-writable:
Store a Netcat reverse shell payload is /etc/copy.sh:
Start a pwncat listener and execute backup.pl as root:
Now we have a root shell:
