# Tre

1. Ran a TCP scan via NMAP

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FIEpZqaHMoQpqRYCfPRIA%2Fimage.png?alt=media&#x26;token=ccf8097d-9c4d-4741-a778-3e70a2228645" alt=""><figcaption></figcaption></figure>

2. Ports 22,80 and 8082 were open. I checked the webpage at port 80 and found the following image.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FZN28F9SoW7fnVFQeaAKo%2Fimage.png?alt=media&#x26;token=b9cb64d4-0603-4779-bce9-ac69c366b56c" alt=""><figcaption></figcaption></figure>

3. I checked the target at port 8082 and found the same web page as above.
4. The next step was to brute-force directories which I did using Gobuster.&#x20;
5. This process was easy yet pretty time consuming for me because the wordlists I was using did not have the keywords for subdirectories which were needed. I had to refer a writeup for this and then used a different wordlist.
6. I found a `/cmd` subdirectory and visiting it returned the following website.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2F4wmfzXMj1qG1xsTE1b7v%2Fimage.png?alt=media&#x26;token=235061f0-4f5c-4dc5-b067-528c1cd666f1" alt=""><figcaption></figcaption></figure>

7. I enumerated the website but found nothing of use. Later after changing the wordlist I ran the directory scan again using the following.\\

   ```bash
   gobuster dir -u /usr/share/wordlists/dirb/big.txt -w 192.168.197.84
   ```
8. Out of all the subdirectories found, two of them could be put to use.\\

   ```
   /adminer.php
   /mantisbt
   ```
9. I visited  `adminer.php` and found the following.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FSuaRVvuFjsMlYFUkJYQf%2Fimage.png?alt=media&#x26;token=69d35f04-292f-4115-ae94-0870132d0002" alt=""><figcaption></figcaption></figure>

Adminer is (or was) a database management tool solely written in PHP. Here I had a login page for the same.

10. Next I visited the `mantisbt` directory and found the following login page.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FkKA7QPqkPy9S7SOIs4qR%2Fimage.png?alt=media&#x26;token=24ccda22-e72a-4613-a1bb-fc222e584dc8" alt=""><figcaption></figcaption></figure>

Apparently, mantisbt referred to Mantis Bug Tracker which is a bug tracking tool written in PHP too.&#x20;

11. I tried logging in via default mantisbt credentials which were `adminstrator:root` but it didn't work.&#x20;
12. Next I ran a directory brute-force scan inside the `mantisbt` directory and found a `config` directory.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FyO0JFlIwZXU68ve9JYOE%2Fimage.png?alt=media&#x26;token=3087c58b-eed7-4ecf-9a06-457e816a23b3" alt=""><figcaption></figcaption></figure>

13. Here `a.txt` seemed a little off relative to the other files present here.
14. Upon opening the file I found the following database credentials.&#x20;

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2Fbyc8VRP7zpIHUl4slCi7%2Fimage.png?alt=media&#x26;token=966d4dca-7ba1-4b69-ae43-b816d1f0575c" alt=""><figcaption></figcaption></figure>

15. Bingo! I could use these credentials in `adminer.php` now. Initially I also tried to login to Mantis BT using the username and password here but it didn't work.
16.

```
<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FqyfSg213goVWmAtPINLe%2Fimage.png?alt=media&#x26;token=0bc7485c-32e4-4b40-9de6-1ad5bd76569f" alt=""><figcaption></figcaption></figure>
```

17. Here I had logged into adminer and could see the above interface. I scrolled through the long list of tables and viewed the data inside `mantis_user_table`.&#x20;
18.

```
<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FtXiFwfHsuuvX38utjiCJ%2Fimage.png?alt=media&#x26;token=15df2444-36ec-418a-9b6c-bdd87f5b9b90" alt=""><figcaption></figcaption></figure>
```

19. I tried using the `administrator` and `tre` credentials in the Mantis login but none of them worked.&#x20;
20. Next I tried using both the credentials in SSH but it didn't work too.&#x20;
21. After a while I tried logging in to SSH again but this time using the `realname` values as the password.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FokRXGSjLH6ABA7k9TGcy%2Fimage.png?alt=media&#x26;token=54db4dbe-130c-4960-8632-a0ae1adc1c55" alt=""><figcaption></figcaption></figure>

22. I was able to get SSH on the target for `tre` user. I also found the first flag in the working directory.

## Privilege Escalation and root

1. Next, I ran `sudo -l` and found the following.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FUkljsIbfvbfMjRu01VE0%2Fimage.png?alt=media&#x26;token=44168b41-6a41-4372-b6f0-12125255c8f6" alt=""><figcaption></figcaption></figure>

2. The file didn't really have anything of use and all the data was encoded. I viewed the data using `strings shutdown` but found nothing that I could comprehend.&#x20;
3. After that I ran `pspy` <https://github.com/DominicBreuker/pspy> , to check the running processes on the target.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FtXbCCqE5Pffwnjlmr7u6%2Fimage.png?alt=media&#x26;token=e2a58893-39ba-41f0-920e-f78c581284f0" alt=""><figcaption></figcaption></figure>

4. A file named `check-system` inside `/usr/bin` was running every second. This seemed interesting.
5. I listed out the code inside the file and got the following.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2F1VdVy0jLVXbm0rtQPTmn%2Fimage.png?alt=media&#x26;token=8dab2a40-db01-4c97-ae63-58354e42875f" alt=""><figcaption></figcaption></figure>

6. It also had write permissions.
7. I overwrote the file with `chmod +s /bin/bash` which would give the SUID sticky bit to `/bin/bash` and hence I could then access the shell as root.
8. I ran `echo "chmod  +x /bin/bash" > /usr/bin/check-system`  and then shutdown the system using `sudo /sbin/shutdown -r now`
9. After starting the system again I used `/bin/bash -p` with `-p` for privileged mode and immediately got a proper root shell.
10. The only step left was to get the root flag from `proof.txt` .
