> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/mustacchio.md).

# Mustacchio

![](/files/-McaUA11Xfw7LrQizWpJ)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 10.10.193.190
```

![](/files/-McaUIC6rLESTxhnNE7M)

Just in case lets run a scan on all ports

![](/files/-McaWahiVzuql3XI9UcV)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,80,8765
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,80,8765 -oN nmap 10.10.193.190
```

![](/files/-McaW8wIixAZ5zQ63Jsn)

## Enumeration 

### Port 80: HTTP

Lets visit the site on port 80

![](/files/-McaUdXZ6Pzv_aJVEzn0)

Its a well made website, Lets run a `gobuster` scan.

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.193.190/
```

![](/files/-McaVz8n1BCzNCyIz1-3)

There is a interesting directory called `custom`, lets check it out.

![](/files/-McaWEqyZzMD1bZ1fKav)

We have two folders, after checking them out, the `js` folder has something interesting

![](/files/-McaWQrlDnsgHixBmFOx)

Lets Download this `users.bak` file, it has I think credentials, so lets see what type of file it is.

![](/files/-McaWtGBaiA20Sw7QXdU)

Its a SQLite file, lets open this file with `sqlitebrowser`

```
sqlitebrowser users.bak
```

Looking through the application, we can see the hashed password for the user `admin`

![](/files/-McaXGbn8kr6JoDjmXra)

Lets crack this. First save it in a file called `hash`, and then lets use `john the ripper` to crack the password.

![](/files/-McaXeFZNe_oPwT0Jmw7)

We have the password, but we do not have a place to login, lets check the other http page running on the machine

### Port 8765: HTTP

![](/files/-McaXx1Dhlc9ROWvk3qJ)

We have a login page, lets login with the credentials we just found

![](/files/-McaY6TKtFI8YUWezr4T)

It is asking us to submit a comment, lets do this.

![](/files/-McaYYh1dlTVwI-G2bbB)

We do not see what is happening clearly, so lets capture the request on `burp` and check what is happening on the backend of this website.

![](/files/-McaYztCeOvUmX2-nXzI)

Lets send this to `repeater` so that we can test different requests. Lets submit the request.

![](/files/-McaZE40O-t2CtXkvqkQ)

Ok we have several interesting thing to look at.

* We have a username `Barry`
* The URL `/auth/dontforget.bak`
* The POST parameter is called `xml`
* The function `checktarea`

First lets look at the `/auth/dontforget.bak` file

![](/files/-McaZtP_S_b7cQ_WXeY1)

Ok, it contains xml. Lets check if it is vulnerable to `XXE` 

![](/files/-McabpJ6KwsSq9EYrz7n)

## Exploitation

We can see that it is vulnerable , now lets try to read the `id_rsa` file

![](/files/-McaeloXmtVWCKotNAJl)

Once we submit this we get a response

![](/files/-Mcaes_c5CSZtw1WWHi9)

Its a private key, lets copy it, we can copy it easier by going to the source code

![](/files/-Mcaf1YjXfuzm6MF2O9K)

![](/files/-Mcaf9r2niN_bVzWXkbH)

Once saved in a file called `id_rsa`, lets crack the password using `john the ripper`.

![](/files/-McafTYCdi8apQbVwzwv)

Now we have the password for the user barry, lets login through ssh. But first we need to set the right permission for the `id_rsa` file.

![](/files/-McafpC9tb9ubdO_EPb8)

We can read the `user.txt` file

![](/files/-Mcag2Ybow93lsXvZPp6)

## Privilege Escalation

Lets look for `SUID bits`. 

```
find / -perm -u=s -type f 2>/dev/null
```

![](/files/-McaiXBTu3dvuX5WQOLz)

The `/home/joe/live_log` file looks interesting as it is not a common `SUID` file.

Lets look at what the file is doing

![](/files/-Mcaj7mA8GEHQGv-eNni)

They are logs, lets use the `strings` command to see more information on the file.

![](/files/-McajLYxnnMT0zIcMvrg)

The highlighted lines look interesting.

Looking at it for a while, we can see that the tail command is used to show the content of the `/var/log/nginx/access.log` file, we can exploit this by creating our own tail binary, and execute it so that we can get root on the machine. We can do this by changing the `PATH` variable to the directory we mention.

Lets first make a file called `tail` in the `/home/barry` directory and add these lines of code.

![](/files/-McalAd31xv9SNjKp2pq)

Now lets give the file all permissions

![](/files/-McalEgOhRc1r1J-lUUG)

Now lets set the `PATH` variable to `/home/barry` as the tail file is here.

![](/files/-McalWD_dVUhUdCK861G)

Now in theory if we run the `live_log` file, we should get root, so lets do that.

![](/files/-McaljUC6PZv0Vi7HRh8)

We are root. We can also read the root flag.

![](/files/-McalrFYnJt-CAbbieY1)