Skynet
Room Link: https://tryhackme.com/room/skynet
nmap -A 10.10.13.172
smbclient -L //10.10.13.172
There is also an email from Miles Dyson, as it's just his name I tried different varations of his name for a username. There is a folder on samba that could be the username as well, milesdyson.
We can now login to squirrelmail that gobuster discovered.
Downloaded all the files from the milesdyson folder on smb.
None of the passwords worked or default credentials for cuppa.
Found an exploit for cuppa LFI/RFI
Testing LFI and it works
Now we will try RFI to get a reverse shell
Kali #1
Create PHP reverse shell then host the file
Kali #2
Browser
Get autocomplete
There is a backup script that is ran every minute by root which backs up /var/www/html
Victim
We can use the following from gtfo to create a reverse shell. The checkpoint argument lets us run a command before the files are tar'd so we will create a reverse shell in /var/www/html and then the commands will execute when the folder is tar'd next.
Exploit Link: https://gtfobins.github.io/gtfobins/tar/
Kali
There is a password in the configuration file, it does not work for root but we see in the home directory another user called jjameson
We can login as jjameson
Last updated