by ngn

Yet another Mr. Robot themed challenge.

Room link: https://tryhackme.com/r/room/whiterose

Once we make sure that we are able to access the target system by using ping, we can start with our basic nmap scan

$ sudo nmap -p- -T5 10.10.240.72

From the output, we can see that the target system has 2 ports open, Port 22 and Port 80.

When visiting for the webpage using the IP Address, the webapge is being redirected to cyprusbank.thm. So, you can edit the /etc/hosts file to add the server address to the domain name.

After we have reloaded the page, we only see a static page without any functions or features defined.

Therefor, we can now try to find for any files to be present in the sever which we can try accessing.

In this case, we will be using ffuf for fuzzing for the files.

And we find nothing from the server. We can try to find some virtual hosts under the domain using ffuf itself.

We instantly see an admin subdomain being shown up to us, which means that we have a valid vhost that we can now start to enumerate.

First off, let's edit the /etc/hosts file again to add the subdomain to be able to access it through the browser.

The index page of admin.cyprusbank.thm redirects us the /login page which then asks us the credentials for logging in. We can use the credentials that we obtained from the Challenge description.

We can log in as Olivia Cortez, but that user has only have limited permission. We cannot read all the data, and the settings page is not allowed to be accessed with this user's privilege.

By some searches from the internet we can find really useful blog post from eslam.io (EJS, Server side template injection RCE (CVE-2022-29078) - writeup) which explains us as well as showcases us the RCE Exploit.

So, now, let's modify this payload to our use, in this case, I will be using reverse shell payload generated from Revshells using the BusyBox reverse shell.

Our Payload is:

Before we actually pass this payload through BurpSuite's let first setup a listener

And now, pass the payload.

And we can see the connection being made to our system.

Now! We got a shell!!!

Let's upgrade the Shell to be a bit more useful than what we have right now, which we can do through python.

First, type in the following command:

Spawning /bin/bash using Python’s PTY module, and connect the controlling shell with its standard I/O.

Then, once you get a shell, press Ctrl + Z which will backend the shell, then update the local terminal line settings with stty and bring the remote shell back.

Now, let's go the /home directory and get the first flag.

When we run the command sudo -l we see that we are allowed to run sudoedit as root without a password using sudo for the specific file /etc/nginx/sites-available/admin.cyprusbank.thm

There is a vulnerability in the version of the sudoedit that we are using in the target system (CVE-2023-22809).

Now, understand and following this Blog CVE-2023-22809: Sudoedit Bypass - Analysis we can make the sudoedit file open any file that we want with the root privilege.

To escalate our privileges to root, we attempt to edit the /etc/sudoers file using the explanation from the blog.

then:

Here we target the line with the command allowing us to execute that specifies the sudoedit command:

and replace it with the following:

Now, when you run the command sudo su, you will be be a root and user.

now, you can print out the root flag.

And we finish it!!!!