Whiterose (THM)
Yet another Mr. Robot themed challenge.
Intro.
Welcome eveyone once again we have another Mr.Robot theme machin by try hack me so excited.
Enumeration.
Port Scan.
As usual we have an SSH, HTTP open ports let's see what we have in HTTP.
enumerate subdomains.
So when i first accessed the web it could not found the domain cyprusbank.thm. So i had to add it into the etc/hosts file. and i tried to use gobuster to enumerate the subdomains and i found this.
And we have a creds which has been given for access this admin panel. and as in the show Eliot uses her to gain access into the Cyprus National Bank.
accessing admin panel.
After we access the admin panel we going to find multple transactions in billions.
Accessing admin account.
So after few minutes playing around i found the chat.
The first thing intrest me in the page was the 'c' argument in the url so i play with it do we. and i found that it allow for chat history.
Using this "Gayle Bev" and password. Yeah i forgot we need admin access for the settings we can not access the settings as Olivia Cortez.
using the settings i was able to change the password for 'Tyrell Wellick' to 'password'. But this step was no good.
from here i was able to get the phone number for tyrell Wellic.
Web Shell.
So i think why would be there a setting where i can change the password but it does not work this does not make any sense right ?.
So i start play around and i found out this.
If we deleted the password value from the request it will give us this error indicating that the password is undefined and also tells us that it uses ejs.
searching a bit on exploit regarding ejs i found this.
which is a CVE effects some versions of ejs. using the payload from the write-up i was able to verify that this version is infected.
so i use a simple reverse shell in upload it to the server.
changing the permission of the file.
Then we just run the send the request and do not forget to setup the listner.
Root Shell.
as for the root shell it was not that hard.
we can see we can use sudo edit to edit some config file let's see if we can take advantage of this.
this repo here shows a CVE which allow us to use vulnerable version of sudo edit to edit any file and therefor we can edit the sudores file to allow us to run any command as root.
we can use the repo or this two commands to get what we want.
after the edit the file should look like this using sudo -l again we can see that we can run anything as root.
conclusion.
Last updated
