Mountaineer (THM)
Will you find the flags between all these mountains?
Hello Eveyone today we have Mountaineer which is a hard machine let's see what we can do.
Enumeration.
From here i do a lot of stuff from wpscan and fuffing and a lot of stuff i even extractred the database.
Which was a valun from wpscan.
But no luck i was not able to find any password and by then i was so frustrated its been 3h to get all these and none of them got me anything.
But thanks to https://0xb0b.gitbook.io/writeups/tryhackme/2024/mountaineer
Mr bob i was inspire to search about misconfigure in Nginx it self. So after reading a bit on https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/nginx
i found that the application is misconfigure.
So it basiclly tricks the website to think that we want to access a file outisde of the web directory.
and from there we can enumerate the server for more info one of the file we can access is.
curl http://mountaineer.thm/wordpress/images../etc/nginx/sites-available/default which will give us more idea on the server configuration. And from there we can one more vhost we was not be aware of by the way i did enumeration about subdomains and vhost using gobuster.
So we only need to add this to the host file. and let's visit it to see what we have.
So from here i tried to bruteforce but it has rate limit so i belive that we can guss the password since we can not break the passwords nor bruteforce or maybe there is another way am not aware of.
I tried with most of them and luck me K2 works which i guess you can tell what the passwors is.
From there we can find two emails.
I tried to ssh using the password but it does not work. So i tried to login into wordpress for the user K2 and it actully works.
From here i can recall that we have an upload vuln if we have contributer access at least.
By this i search for an exploit and i fond this.
Which has work perfectlly.
Access shell as K2
this is quite simple we can use the same creds from the roundcube.
Acess as kangchenjunga
So here i stuck for a while we can see that once we login as K2 we can see an email to guy called. Lhotse Which we has access to his directory.
And here i search about this and i found it some sort of encrypted databse which hold some information we can use john to crack so i tride john with rockyou file but it does not work. Thanks to bob again i see that he uses tool called cupp which help to generate some password based on user information.
Shoutout again for bob. https://0xb0b.gitbook.io/writeups/tryhackme/2024/mountaineer#password-generation
So using this tool i provide the information. and it give me a wordlist.
And using that file with john i was able to crack it.
And from there we can access this website.
To see the file content just upload the file enter the key and it will open. ANd from there we can find the username and password for the user : kangchenjunga.
Shell as Root.
So once we login we will find the flag as well as note which actully make me laugh.
So as to became a root its quite simple really. So reading the note above we can tell that the root user use this guy account. So let's see.
Hmmmm is it really ??.
indded. So let's login as root.
conclusion.
At the end this machine was so fun it actully not that hard but there is a key point which actully was challenging such that fact that i spend 3h to use sqlmap to get all the users databae with nothing at the end and the real exploit was quite simple aslo in the crack file it was quite easy but using the person information to get the real password was actully so smart and a new idea i can use in future challenges. Finally i would like to thank and give a credit to bob he really help me thank you bob. Check his write up down show some love.
Last updated
