search

mustacheMustacchio

hashtag
Scanning and Enumeration

hashtag
Nmap:

┌──(kali㉿kali)-[~/tryhackme]
└─$ nmap -sC -sV 10.10.143.113 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-01 15:54 EEST
Nmap scan report for 10.10.44.119
Host is up (0.52s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 58:1b:0c:0f:fa:cf:05:be:4c:c0:7a:f1:f1:88:61:1c (RSA)
|   256 3c:fc:e8:a3:7e:03:9a:30:2c:77:e0:0a:1c:e4:52:e6 (ECDSA)
|_  256 9d:59:c6:c7:79:c5:54:c4:1d:aa:e4:d1:84:71:01:92 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-title: Mustacchio | Home
|_http-server-header: Apache/2.4.18 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.23 seconds

hashtag
Results:

2 ports are open:

  • HTTP

  • SSH

hashtag
HTTP:

hashtag
Enumeration:

hashtag
Gobuster:

There are some important directories found:

  • robots.txt

  • custom

Now, lets check robots.txt

Nothing important here

Lets now check custom:

In /custom/js, there are 2 directories:

  • mobile.js

  • users.bak

The important one is users.bak, Lets check it out:

So, the username is admin, and the password is hashed.

This is the password: 1868e36a6d2b17d4c2745f1659433a54d4bc5f4b

Lets head to https://hashes.com/en/decrypt/hash , decrypt it, and find the plaintext password:

So now, we have a username and a password.

  • username: admin

  • password: bulldog19

Now, I was stuck, until I discovered another port open, which is port 8765.

Lets check its contents:

There is a login page.

Lets login using the credentials we got.

Admin panel appeared

Lets check source code:

There are 3 important things we can conclude from the page source.

  • This directory: /auth/dontforget.bak

  • User named Barry

  • There is XXE injection

Lets now check the file dontforget.bak:

It is in this url: http://10.10.143.113:8765/auth/dontforget.bak

Lets check it out:

So, we can deduce the xml code we should insert:

It should be in this format:

hashtag
Exploitation

Now, lets use everything we deduced above for exploitation. (Injecting xml code)

Lets head to hacktricks, to the XEE section:

In the Read File section, there is these:

Lets convert these to the format we want, which is this:

This is the result:

So, lets get the ssh key:

First, we should fix its format, then use ssh2john, then crack the passphrase.

Now, lets chmod 600 id_rsa:

Lets crach the hash:

Now, lets ssh in with this passphrase:

lets find the user flag:

User flag: 62d77a4d5f97d4xxxxxxxxxxxxx

hashtag
Privilege Escalation

hashtag
SUID:

There is this file:

This runs as root.

Lets check it out:

There is an important line: tail -f /var/log/nginx/access.log

So, what we can do is we can abuse the $PATH environment variable, to create a file named tail, and open a shell as root.

Now, lets run live_log:

and we are root!

Lets find the root flag:

Root flag: 3223581420d906c4dxxxxxxxxxxxx

PreviousGaming Server

Last updated