OLYMPUS — Tryhackme

Olympus

Well… Happy hacking ^^

Performed an Nmap scan on the target IP and found that port 22/ssh and port 80/http are open. Since the specified IP address does not load, we need to add the IP to the hosts file with the DNS record as olympus.thm.

Nmap scan

Website port 80

olympus.thm

There is a message on the website indicating that the previous CMS version is still accessible, so a Dirbuster scan was performed on the target.

Dirbuster

Navigate to the directory that was found. The only important things we see are the search function and the login page.

/~webmaster

So, use the search function and add the payload [1'] in the search field. You'll see that there is a SQL syntax error. The next well-known step is to use SQLMap. You can refer to this blog about SQL injection using SQLMap.

SQL syntax error

capture the request and run sqlmap

request

sqlmap

database

sqlmap -r req.txt — batch — tables Olympus

table Olympus

Database dump

found flag and users

So, the cat_id parameter is vulnerable to SQL injection and can be used to read data from the backend database. With SQLMap, it is possible to enumerate databases, tables, and columns using the following options:

• Use --dbs to list the database names. Once you have identified the desired database, you can specify it on the command line with the -D <DB NAME> option.
• Use --tables to list the table names. Specify the table on the command line with -T <TABLE NAME>.
• Use --columns to list the column names within a table. Specify the columns with -C <COLUMN NAME>.
• You can dump the entire table using --dump.

the cat_id parameter is vulnerable to SQL injection

Found the first flag.

flag 1

There is a table named ‘users’. Dump the table and look for important details.

table user

Dump the data from the users table.

found user and password

There are usernames and passwords for three users. Copy the hashes and use John to crack the passwords. John was only able to crack Prometheus’s password.

crack Prometheus’s password

Now log in with the credentials that were found.

login

Admin page

Dump the users file again.

Dump users

There is another subdomain called ‘chat.olympus.thm’. Add it to the hosts file and start hacking.

found subdomain

After accessing the website, we see a login page.

chat.olympus.thm

There is an upload option on the chat page.

upload option

Upload php_reverse_shell.php

malicious file upload

After wondering where the uploaded files go, I scanned with Dirbuster and found the /uploads directory.

/upload

After seeing a blank page, I remembered the table from the Olympus database related to chat. Let’s try SQLi again and extract the data.

table chats

Here, you can see that all file names are encoded in a certain way and changed to something else. For our uploaded file, the name was changed from reverseshell.php.

found file names are encoded

Now try to access the uploaded file in /uploads while starting Netcat at the same time.

reverse shell

At this stage, we have a reverse shell from the website with the www-data user. To access the zeus directory, we need to escalate our privileges or log in as zeus. Using the command find / -perm -u=s -type f 2>/dev/null, we found an interesting file called cputils.

cputils

That file is interesting because it can be executed as zeus, and its function is to copy files.

its function is to copy files

Immediately copy Zeus’s private SSH key so that you can log in as Zeus.

User Zeus

Found the second flag in the zeus folder, and we obtained the id_rsa by running the cputils file.

flag user

Read the id_rsa file.

id_rsa

Downloaded the private key, but when trying to log in, it asks for a passphrase since it is password-protected. So, use ssh2john to generate a hash and crack it.

ssh2john

SSH into the system as zeus.

zeus

Run the command find / -type f -group zeus 2>/dev/null.

find / -type f -group zeus 2>/dev/null

I tried searching for files to use for privilege escalation and found /var/www/html/0aB*************/VIGQFQMYOST.php. So, I tried reading and analyzing the file. It simply does something straightforward (runs a binary) to gain root access.

privilege escalation

Run the same code in the terminal as zeus since it grants us root access.

user root

Go to /root, find flag3, and read it.

flag root