TryHackMe! Tartarus - Website Password Bruteforcing

Hello everyone, my name is Jon Hammond and welcome back from the YouTube video. We're still looking at some TryHackMe rooms and this video was super duper requested by Dark or D4RCKH. So shout out to you my friend, this video is for you. We're finally taking a look at the Targarus room. This is a beginner friendly room. It's titled a beginner box based on simple enumeration of services and basic privilege escalation techniques. So I've spun the machine up here and I already have some of these user flags and root flags submitted here. So please forgive me on that, but I'll showcase how we can get each of those. So I will hop on over to my terminal where all the good stuff happens and I will cd into ctf, TryHackMe and I believe I already have a directory for this recording. Yep. So let's start off with a readme if we want to do to take good notes. We can start off with an nmap scan. What I'm going to do is I'm going to use rust scan because everyone is all about that lately. I'll set a batch size of 500 and I will slap in that IP address and we'll see what we get. Looks like we have port 21 open or FTP, port 22 open for SSH and port 80 open for HTTP or a website. With that said, we have a few things we can go explore. I'll fire up that IP address and we have a default Apache page so we could do our usual tests to check out robots.txt, see if that's a thing. Looks like we do have that and there's dark again. Great. So we have an admin directory that is not supposed to be admittedly found right at the start. So let's check that out and there we go. We have admin dir and this is directory listing for credentials.txt. Okay. These look like potential passwords. Let's store this. I will wget this guy just to download that and what is that user ID? Okay. These might just be names for users. So maybe credentials is a list of passwords while user ID is a list of usernames. That is worthwhile. I don't know where we're going to end up using this. Maybe we can try Hydra because we have SSH open but we should do some other enumeration other than just kind of our manual robots.txt. So I will start a little Nikto session. I'll Nikto this guy. T him to Nikto.log. Nikto, just a simple web scanner, tack H to specify the host and I'll supply in the HTTP prefix for this URL. I'll spin him off. I'll move my Rust scan because I'm sure he'll pass that to nmap and do some good stuff with it. But let's also start to run some GoBuster. So let's GoBuster dir tack URL. So that U there to specify that and I'll use the word list from my directory list medium that it typically ships with dir buster. We could let that run and we could also specify some extensions if we really, really wanted to. But while that is enumerating, let's go ahead and take a look at some of those other services because we know we have SSH open. If I were to try and Netcat to that guy just to grab a simple server banner, looks like we do have open SSH on Ubuntu. So we have a good idea this is and we kind of had that same thought and we're looking at an Apache Ubuntu default page. There's nothing else in this source code here. I hit control U just to view the source on the webpage. I don't see any hidden comments or any other gimmicks that they might be trying to trick us or fool us with. So let's take a look at that FTP URL or that FTP port we could access. Let's connect with my simple command line client FTP here and we'll see if that ever comes back. There we go. Or not. Connection timed out. Is the box still up or did I hose the thing? Box is still up. We do have FTP on there, don't we? There we go. Okay. Okay. Looks like I'm running vsftpd. That is a later version of vsftpd. So there are some pretty well known vulnerabilities for vsftpd or the very secure file transfer protocol daemon. But a lot of them are very, very old. If you see like 1.3.5, that's normally a big one to check. Anonymous, it might have anonymous access enabled and we might already be able to see that if we've kicked off Nmap, which we have. So Ruskan found these three ports very, very quickly and now he's going to give that to Nmap to do some actual enumeration with the aggressive flag and very, very verbose and those specific ports. So I really, really like Ruskan. It looks like he's already finished. Cool. And there is anonymous access enabled and everything that we already found. Nikto found our robots.txt here. Sorry, that's humongous. Robots.txt contains one entry, which should be manually viewed. Anyway, let's get back to our FTP enumeration. If we're logging in as anonymous, we don't need to specify a password. So I can just slap enter there. And now I am connected and I can run ls to see the commands I have here for the files on the file system. I do see this test.txt. We can go ahead and get that, as we would. And simply looking at here at that test.txt file, that's the classic VS FTP test file. Grr. Okay. Annoying. I did that also in Pkill, which is my room on TriHackMe, where I just left that file there. Also, shout and call back to Pkill. Don't forget when you're working in an FTP client to check for the hidden directory. So you can do that with ls tack la, or that a to note all files. And we see an interesting one that has three periods rather than one or two. So that symbol for one period or a dot means the current directory. Two periods will refer to the parent directory, but a three periods is not normal. That's not actually a thing in usual computer speak. So they might be trying to hide something interesting there. Note that that is a directory. You can see that d prefix there to specify, hey, that's going to actually be a folder. So let's try and change directory or the cd command into that location. You could run ls again. There's nothing there. Don't forget ls tack la. And now we see more interesting things like another dot, dot, dot. So very, very clever. Very, very tricky. Let's go ahead and cd into that. Again, we can see that as a directory. So let's hop over there. And now ls. Now we've got you got good eyes dot text. And just for our safety, ls tack la, and there's no other excess files. So it looks like you got good eyes is what we want to work with. So let's get that. Now that we've downloaded that file, we have this you got good eyes dot text file on my local system. So let's cat that out. And this looks interesting because that forward slash might be indicating that that is a web directory or a location we can access on the website. So I see super secret in some leet speak. Let's go check that out. And this looks like a login page. Okay, very, very cool. We know we have credentials previously from when we found that robots dot text entry. So maybe we could try some of the credentials here. But it gave us a username list and a password list. So maybe we have to try and brute force some of these here. So you could do this with Hydra if you wanted to. I really don't like doing that primarily because I dislike the syntax for Hydra and because trying to determine and figure out whether or not it properly got a new page or successfully authenticated or not is really frustrating and annoying. So what I'm going to do is I'm going to look at the source code and see how this actually works. And I'm going to write the script to log into all this and brute force this web login page with Python. So stick with me. I hope you don't mind. Let me open up my terminal and I'll start a like web brute dot pi file. And I'll bring that down. I don't need to have some of my CTF challenges visible there. So let's go ahead and start with a shebang line. User bin environment Python 3. I'm going to be working with online web stuff. So I will import the requests module. I'll go ahead and create a session. I'll use an S object or a variable to capture that session. And for good practice, I'll go ahead and close it and leave that at the very end of my script here. So we know that we're working with this URL. And I'll specify that as a string variable. But this post request, this actual form submission is going to a very specific page that's going to the action attribute in this form HTML element. That's going to authenticate dot PHP. And it's going to post to that location. So rather than using super secret as the URL, we actually want to make sure that we're using based out of that current directory going to that authenticate dot PHP page. Let's go ahead then and now take the names of each of these variables that this form is waiting to accept. So I see username and I see password. And it's also good practice to just kind of include the submit value as well. So let's go ahead and try that. Maybe we could just simply define a login function. And maybe, you know what, I changed my mind. Maybe we won't need to use a session because if that's going to be logging in potentially one of these will actually get a hit. We don't need to capture that and keep it. So forgive me that I guess we don't need to do that. We'll just use the regular requests module. And let's continue our function though. Let's get a username and password that we could simply supply here. And then let's do an R for requests object to do a requests dot post to that URL, which I will move up so we can actually have that variable defined already. And I'll include the data here that we're going to post. That'll just be a dictionary object. So username is simply what we will pass. The string variable is going to be the key here because that's the data variable that that form or that web page is actually going to expect. This without quotes username is going to be the variable that we pass in to this login function. I'll do the same thing for password. Password that will again be what we pass in. And I'll grab that submit value as well just for good practice. That will be a constant or static string there. Okay now we have an R object. So we can print that or just return that I suppose actually. And we can print it later outside of that login page. But now let's just try to print login with John and please subscribe or please sub. Cool let me fire that off. I'll hit control B and we got a response 200. Let's actually grab the text of that page and see what it's going to return to us because that might tell me oh incorrect username. Oh that's actually some good info because we could go ahead and actually check what the username is before the password. If it's going to tell me just that first detail that my username is right or wrong then I don't have to like test every single one of them. I can just start enumerating all the usernames and then I can start enumerating passwords after I've found the correct username. So let's go ahead and open up these files. I'm going to kind of collapse that page and let's get a little open function here. User ID is the name of that file that has all of the usernames in it and R to read it as a string. I'll use a little context manager here. So I'll use with with open user ID read in with just a regular reading without bytes. I don't need to use that B prefix here because I just want to pass in a string. I'll use H and I'll use H dot read lines or I'll just use H dot read at least that way I can do some simple list comprehension to remove all the new lines and properly read that as a list. So what I'll do is I'll just say usernames equals H dot read. H dot read will return a big long string of all of the content in that file. So I'm actually going to end up splitting that on new lines and I will actually go ahead and strip each of those. So I'll do a line for line in this. This is some list comprehension so some inline Python. H dot read it'll be the data that we're looking through. We'll split it to get it into a list format then we'll iterate through each of those for line in and then we'll create a new list with that variable line being our iterator but we will strip out maybe any access new lines or stuff that just happens to be in there. So after that I should be able to print out usernames and now I have a big long list of all of these here. It looks like I do have an excess. So that empty string can also be kind of easily removed if I just do if line in the list comprehension. So that line if that line actually exists if it's not an empty string it'll go ahead and include my if line at the very end there will make that go away. Okay we have all the usernames now let's grab all of the passwords. So with what is that credentials.txt is that right? Yeah I think so. Ls yep credentials.txt cool. Let's grab passwords. Okay so because we know from our little test earlier just with our simple login function we can determine if it is the correct username or not. So let's start by usernames first and just passing in a bogus password. So let me do a for username in usernames we can go ahead and try and log in. Let's actually get a response variable and let's print out with a simple f string so I can say username with the username variable passed in we'll get this response. There we go and let's try to run this and I have a printf accidental. Okay let's do this in the terminal so you have a better look on it actually. Let's do python3 webbrute username dark incorrect incorrect 32 diablo all those enox incorrect incorrect all of those are seemingly incorrect. Hmm why is that? Oh because I forgot to change the variable that we passed in it is not going to be john anymore it's going to be our username. Classic good sanity check you guys should have told me you guys should have yelled at me like why why didn't you let me know that I was wrong there? You probably did. Running this again I see an oddball I see this enox user gets an incorrect password so we know he is probably the correct username because all these others are returning incorrect username and that one got past that layer of logic so enox must be the right username. Now let's try that with the correct password or try and brute force a password so for password in passwords plural we can specify enox and then the password that we're looking for so username enox password hmm password can be passed in I can type I promise and let's see how that goes let me try and connect to that incorrect password incorrect password incorrect password etc etc uh that's going to change the screen so let me go ahead and clear that for you good brute forcing I know Hydra probably could have done this just as well but oh okay we actually got a hit it was able to log in seemingly with the credential enox and password 1234 good to know let's take a note of this let's just actually if we were to have our readme.md we would go ahead and keep track of those credentials so let's get that done save that and now let's go ahead and log in now that we know that enox and password 1234 okay now we have an upload page where we can upload a file I don't know what kind of file we might be able to upload but we could certainly try anything the most fun thing to try would be some php code to get code execution right so let's go ahead and copy over our opt php reverse shell and let's get that into this current directory I'll actually move that to I guess rev shell dot php let me check out what my ip address is ton zero and I am 14 11 so let's modify this rev shell and use that ip address so it will call back to me with my reverse shell and I'll listen on quad 9 9 9 9 or quad 9 I don't need to say all those nines if I've already said quad that's the whole point of saying quad so that is now something that I could upload and let's start to listen on things let me close out of some of these shells that we don't need anymore and go buster doesn't need to keep working let's go ahead and I guess start pwncat that'd be fun pwncat um source environment bin activate pwncat does weird things with the um with the php reverse shell though let me try it I'll show you I'll show you what I mean python tack m lp and I used quad 9 right python tag m pwncat sorry now that he will be listening tack lp now that he will be listening we're really doing well for this video guys let's upload our reverse shell that should be in ctf try hack me tartarus slap in a rev shell upload that rev shell has been uploaded now where is that going to actually upload to doesn't exactly tell me where so I guess I can kind of start guessing is that in simply rev shell.php no is there an uploads directory no is there an upload directory where did you go where did you put this thing rev shell.php super secret all right let's try some dir buster on this location because apparently we need to go buster dir http you word opt directory wordless please crank on that found images okay what is in images there is an uploads directory and images and that has my rev shell what is this podcast thank you try hack me thank you you're the best rev shell.php click on that we should have our callback coming through ideally no failed to demonize did I have the right port in there did I do something wrong did I do something wrong again and you guys didn't tell me oh no no no no I used the bad ip address I am listening on ton one right now I'm a fool so you know what the problem is guys to be honest the problem is I've been trying to do more videos for you and I put in my hack the box address don't tell anybody don't tell don't tell try hack me don't can I your stinking log back in please what is it you were home.php yeah okay cool rev shell do it uh are we still listening no we aren't now let's get back to listening let's change these preferences or this profile to be black so it looks like I'm on the attacker machine and it's super cool and stuff images uploads rev shell whack that and there we go now our connection's coming through okay it's gonna take a little bit of time with PwnCat uh we are working on PwnCat by the way uh we are trying to make it a little bit better because obviously some of the stuff is a little bit slow and funky and weird also it's not very extensible if you want to pass in more arguments for a specific thing that you're trying to do like running a module with real specific I don't know variables and parameters and options that you want to specify um like maybe doing enumeration or privilege escalation with crontab stuff because we're trying to make it better we're trying to improve it so we thought well originally we didn't want to go with like a Metasploit-like methodology in retrieving information or supplying information so we didn't and now we're reconsidering that um what is this database doing guys did I not specify oh I didn't specify a config file so it's also probably whining about that okay okay okay let's no PwnCat sorry gosh I hate doing that in videos and then everyone's like uh didn't do it let's uh try and stabilize our shell so let me verify do I have Python on here I do do I have Python 3 I also do so it doesn't matter which stabilized shell I really use uh 2 or 3 um that script that I just ran comes from my poor man's pentest framework so if you're interested in that sort of thing I have a talk on that on my channel um but let's see what's going on I am www.data the Apache or engine or HTTP daemon service the user that's going to run the web server and that's a low privilege user there's not going to be a lot going on right now so I need to do some privilege escalation and try and move into a better looking account I could do manual enumeration I could do stuff with PwnCat to do enumeration I could run linps I could do plenty of things let's take a look at what we have in etc password first just get an idea for these users so I see a 32 user and there's dark again fantastic is this your room buddy I don't know what's going on so what can this account do it's always a good idea to check sudo tack l it would be very very weird for www.data or a web account user to be able to run commands with sudo in this case we can so good for us right our attacker point of view that's great I will take code execution when I can get it especially as another user but maybe that's not normal on a web server it shouldn't be right so 32 this other user that we saw on etc password can be used we can access www.data and use his account to run var www gdb or specifically this command without a password as the 32 user so gdb has gtfo bins or has code that we could simply run to execute commands or do malicious things or read files or write files or upload files or peculiar stuff so if you go to gtfo bins.github.io there's a great resource for all these Linux local binaries and common utilities that can be used with certain privileges or permissions to do other things like escalate potentially so this can spawn a shell and it will run with this syntax gdb I think it's I don't know what the nx is no execute or x or some command it can specify yeah ex looks like it's specifying a command but let's go ahead and try and slap that in with our sudo syntax I'll use sudo to specify user with tack u 32 will be the user that we're going to use and we have to use this specific command right var www gdb get that exact location in and I'll paste in gdb with that syntax now if I whack enter you can see gdb has started for me but down below I have a dollar sign prompt which is not what gdb usually does so if I run id I'm running as that 32 user so we've executed sh or started a shell let's actually sort of bash so I have a better prompt here I can check out who am I and I am still 32 so that works just fine we could go into 32's home directory looks like he has a note.txt hey 32 the other day you were unable to clone my github repository now you can use git took a while to fix it but now it's good incredible where's my user.txt am I supposed to have a user.txt user flag should that have been dubbed up to data or is that going to be dark that might be dark let's check out what we can do as this user once again simple sudo tack l just to verify looks like he can run as dark this user bin git so once again git is a gtfo bins that can be used and abused pwncat can do this pwncat does weird things because the privilege escalation enumerate enumeration technique that it uses actually finds the setuid bit first on that binary rather than running it as sudo so it tries that and then it doesn't properly get it we're still working the bugs out right that's the whole point of it we wanted to release it kind of in development so showcasing what it's growing and what it's learning to do anyway you don't care about that stuff sorry for my tangents dark as the user that we want to run the user bin git and we'll slap in the syntax uh let's try this one you could use this one because this one is actually setting a variable it doesn't really work uh and initially especially if we're trying to use sudo with this but git help config will launch the default pager which is usually less just like kind of that explains it is less and you can tell because of our paginated input or output i can use up and down arrow keys actually get stuff so i can use the dollar sign to try and run a command and i will simply run bash there we go and now my prompt has changed and i am dark i am the new user i've once again done our horizontal privilege escalation if that's the proper word for it whatever dark let's go into his home directory do we have user dot text we do have user dot text all right let's slap that in get those points and win try hack me just in general win try hack me what is this cleanup.py scripts looks like it's a python script right so let's cat it out see what we got here user bin environment python import os import system how is this ran or is this ran looks like it sudo attack l can i invoke that oh i need to know his password and i don't know dark's password so that's annoying okay so maybe that cleanup is ran by cron or something all right we could check this out if we were just looking in etc cron tab let's see what we have here i do see a weird entry it kind of slid under the radar because it's not at the very very bottom it's kind of at the top so it is minute hour day of the month month day of the week user and it looks like we have every day every minute of every hour but every minute divided by two so every two minutes it will go ahead and run cleanup.py now cleanup.py is in our home directory it's in this dark user's home directory that we have access to so since this cleanup script that is ran by root is in our home directory oh and we can actually write to it and control it right then we could make it do whatever we want right we could very very well change this os dot system command to actually run another command like get a reverse shell or copy the root file to a file location we can access or what i really like to do is mark bin bash as a set uid binary so that way it will able it'll be able to be invoked by us and we can keep the permissions of root and that root user that actually owns that binary and we could actually use that to do some privilege escalation so if i actually monitor the sticky bit or the permission set on bin bash you can see right now it's currently just regular rwx but after our half a minute hits after we get to minute 54 or the multiple of two and even number every two minutes right that should trigger and because it's running as the root user root has a permission to add that bit to this binary and then we'll be able to use bin bash tack p and keep our privileges as root so we got five seconds four seconds we got a little countdown let's see if it does it fingers crossed and there it is okay awesome now we can go ahead and run bin bash tack p and you can see my prompt has changed with the middle of hashtag pound symbol octothorpe and i am root so i can hop on over to the root directory here grab that root dot text and that box is done so very very cool very fun um a couple of gimmicks that i think we've seen before in previous videos so forgive me hey we're just i don't like to be doing uh the same thing over and over and over again on different videos but uh dark had really really asked for this so hey i hope you enjoyed i hope this video is everything that you wanted maybe you learned some tricks with that python gimmick maybe that uh bin bash tack p or setting the set uid bit on uh bash is always a fun trick to do but just some good stuff and fun doing some manual enumeration uh as we need to thanks so much for watching everybody i hope you enjoyed this video if you did please do press that like button maybe leave me a comment please do subscribe you know i'm super duper grateful thanks for watching everybody i'll see you in the next video i love you take care