Let's start with a nmap scan. We can see only one open port: 85. We are dealing with an Apache httpd 2.4.7 web server. The title suggests defacing has happened.
┌──(kali㉿kali)-[~/Desktop/THM/mKingdom]└─$nmap-p-mkingdom.thm-T4StartingNmap7.94SVN ( https://nmap.org ) at 2024-06-18 06:32 BSTNmapscanreportformkingdom.thm (10.10.229.74)Hostisup (0.15s latency).Notshown:65534closedtcpports (conn-refused)PORTSTATESERVICE85/tcpopenmit-ml-devNmapdone:1IPaddress (1 hostup) scanned in 147.61 seconds┌──(kali㉿kali)-[~/Desktop/THM/mKingdom]└─$nmap-sC-sV-p85mkingdom.thm-T4StartingNmap7.94SVN ( https://nmap.org ) at 2024-06-18 06:59 BSTNmapscanreportformkingdom.thm (10.10.229.74)Hostisup (0.16s latency).PORTSTATESERVICEVERSION85/tcpopenhttpApachehttpd2.4.7 ((Ubuntu))|_http-server-header:Apache/2.4.7 (Ubuntu)|_http-title:0HN0!PWN3D4G4INServicedetectionperformed.Pleasereportanyincorrectresultsathttps://nmap.org/submit/.Nmapdone:1IPaddress (1 hostup) scanned in 10.85 seconds
Visiting the site we are greeting with the picture of Bowser the famous villain from Mario.
Manually and with Gobuster we reach a blog at endpoint /app/castle.
There is only one blog post.
We see that the CMS concrete is being used. In the source, we also find the version used: 8.5.2. This is vulnerable to authenticated remote code execution.
This vulnerability is explained step-by-step in the following post. The requirement here is to be in possession of admin credentials, as this allows you to modify upload restrictions by adding file types and then uploading and triggering a PHP reverse shell.
Initial Access
We know about the possible entry point through authenticated RCE, but still need credentials.
We can log in with the username admin and a very password that starts with p.
We are able to log in and access the admin dashboard available.
Select System & Settings, then Allowed File Type.
Next, add php, separated by a comma, and save the changes.
We can use the reverse shell from PentestMonkey.
To upload files, we simply drag them into the File Manager at /app/castle/dashboard/files/search. We get the URL to access the file. Before we do that, we set up a listener on our chosen port
We get a connection from our reverse shell as www-data. Unfortunately, we won't find the user flag here. We have to move laterally. By inspection /etc/passwd we find two users, toad and mario.
We run linpeas.sh and discover that cat is a SUID binary owned by the user toad. This means that running cat as a different user will execute the binary with toad's privileges.
$ netstat -tulnp
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN -
tcp6 0 0 :::85 :::* LISTEN -
tcp6 0 0 ::1:631 :::* LISTEN -
udp 0 0 0.0.0.0:5353 0.0.0.0:* -
udp 0 0 0.0.0.0:53109 0.0.0.0:* -
udp 0 0 0.0.0.0:68 0.0.0.0:* -
udp 0 0 0.0.0.0:43628 0.0.0.0:* -
udp 0 0 0.0.0.0:631 0.0.0.0:* -
udp6 0 0 :::5353 :::* -
udp6 0 0 :::33649 :::* -
udp6 0 0 :::46215 :::* -
MySQL is running internally. Maybe we can retrieve some credentials from the web app.
By examining the configuration files, we can find the database credentials. Although exploring the database might not reveal any new users, it's worth checking if the same credentials are being reused elsewhere.
We are able to switch users for toad.
While enumerating the target manually, we find a strange password token in the env variable encoded in base 64.
We can decode it and switch to mario
Here we find the first flag, and we can't read the flag, because of the SUID bit set. We look for another copy of cat on the machine and find one at /usr/lib/klibc/cat, With that, we can read the last flag.
Privilege Escalation
We upload and run pspy64 on the machine to discover processes running in the background.
Here we find a cronjob that uses cURL to download a script at mkingdom.thm and execute it. If we are somehow able to write to /etc/host, we can uplaod a malicious script that executes a reverse shell for us.
We can confirm that we are able to write to /etc/hosts as mario
With nano or vi we can update the /etc/hosts and replace the existing IP for mkingdom.thm with our own IP address
Next, we create the folder structure, create the script, place it in the correct location, and set up a web server on port 85 using Python. Besides this, a listener is running on our desired port.
