Tartarus
Tartarus is a beginner box. This box involves a lot of interesting things including horizontal and vertical privilege escalation, changing shells as well as popping reverse shell.
Initial Foothold
The first thing post deploying the machine that we can do is visit the IP address and check for any information that we can use.
We can see a default Apache page and nothing else. Also, we ca go one step further and check it's source code but even over there we can't find any useful information. So, we can move on and run an nmap scan along with a directory brute force attack.
From the nmap scan, we ca see that FTP is open that too with anonymous login enabled. We can immediately go and check if we can find something over there.
Here, right in front of us we can see a file named test.txt which we can easily download using mget. Also, there is one odd directory present over here which is .... Usually, . is for current directory and .. is for the parent directory but there is nothing like ..., so we can go and check that directory. Going further in that directory we can find a file named yougotgoodeyes.txt, we can download this as well with the same mget command.
The 'text.txt was not of help but the other txt file gave us a hint on a hidden directory /sUp3r-s3cr3t. We can go and check what is present over there.
We can see that a login page is hosted over here. We can try some basic SQLi attack as well as check it's source-code for some sort of information leakage but we can't find anything useful over here. Meanwhile, our directory brute force attack would've been completed.
And we can see that robots.txt file was detected. So, can go there and check if some information is available over there.
We can see that /admin-dir has been disallowed but for the robots we can definitely and check it out.
We can see there are two files, userid and credentials.txt. We can open them and save both the files. It appears that userid contains a list of usernames and credentials.txt contains a list of passwords. We can use these files along with hydra to brute force login on the /sUp3r-s3cr3t login page.
While trying to login with default credentials and SQLi attacks, I observed that the requests were taking me to sUp3r-s3cr3t\authenticate.php. Hence, we must use this path to perform the brute force attack.
In the above hydra command, we have used the userid file for brute forcing usernames using the switch -L and the credentials.txt for passwords using the switch -P. For specifying that we are brute forcing a login page, we have used http-post-form and passed on our authentication page's path and other parameters. The Incorrect* helps to filter out those requests that returned either Incorrect username or Incorrect password and we get the only correct credential pair in the output.
We can now use these credentials to login on the page.
Here, we can upload a file and as this is apache based we can search on the internet for php reverse shell files and use them to gain access to the machine. Once such file can be found here. All we need to do is make some changes to this file and we are ready to go.
Here, we need to enter our local IP address on which we intend to get the reverse shell connection. Also, we can change the $shell to get a shell that we want. Here, I have changed /bin/sh to /bin/bash.
Once, we upload this file we need to open it but we don't know where it is stored. So, we can run a directory brute force attack on the /sUp3r-s3cr3t directory.
Here, we can see a sub-directory named images has been detected. We can go and check it out.
Over there, we can see another sub-directory named uploads which contains our uploaded file re.php. Now, all that we need to do is start a listener using netcat on our machine using the command nc -nvlp 9090 and open the file re.php.
We can go to /home directory and see the different users on the machine.
We can try to check files in each of these directories.
And in the user d4rckh's we can find our user.txt flag.
Privilege Escalation
We can move on to user cleanup's directory now:
But we can't find anything over here. We can also check user thirtytwo's directory:
Here, we can see a note from d4rckh that user thirtytwo can run the command git with d4rckh's privilege level. So, for that we need to first check which commands do we have access to using the command sudo -l.
Not as sudo, but we can run the command /var/www/gdb as user thirtytwo. We can look for gdb command in GTFOBins and find a sudo command for the same over there that we can modify a bit and use.
But this command didn't work because with sudo we try to run the command as root. But from sudo -l we can see that we are allowed to run this command as user thirtytwo and not root. So, we need to use the command:
And then we get the shell as user thirytwo:
Now, we can check the commands that user thirtywo can run:
As we found in the note, we can run the git command as user d4rckh now. So, we can again go to GTFOBins and look for exploit related to git. The one that works from the sudo exploits mentioned there after modification are:
We can run these commands as user thirtytwo and get access to d4rckh's shell but before that we need to get into a bash shell which we get using a python command:
Now, we can try to run the git command as d4rckh.
We can again get a bash shell using the same python command used above for user d4rckh. In his directory we can see a python script named cleanup.py which can be executed as root.
We can modify the content of this file to run a command to store the root flag in the tmp directory. First, we need to create a blank file in /tmp and give access of that file to others as well.
Now, we can change the code in cleanup.py as:
copying and pasting the following in the shell:
We can check if this has been properly added to the cleanup.py file.
Now, as this file is being run by the cron. It'd automatically get executed in sometime and the flag would get written in the /tmp/key file.
And we get our root flag as well. So, with this we have completed the Tartarus room!
Links Referred
TryHackMe-Tartarus: https://tryhackme.com/room/tartaraus
GTFOBins: https://gtfobins.github.io/
Last updated
Was this helpful?