# Spectra (Easy)

## Enumeration

### Nmap

```
nmap -sC -sV 10.10.10.229
```

```
Starting Nmap 7.91 ( https://nmap.org ) at 2021-05-25 01:13 EDT
Nmap scan report for spectra.htb (10.10.10.229)
Host is up (0.25s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.1 (protocol 2.0)
| ssh-hostkey: 
|_  4096 52:47:de:5c:37:4f:29:0e:8e:1d:88:6e:f9:23:4d:5a (RSA)
80/tcp   open  http    nginx 1.17.4
|_http-title: Site doesn't have a title (text/html).
3306/tcp open  mysql?
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 287.64 seconds

```

### Discovery

We can see port 80 is open. Let's navigate to that

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWw1zrtNbaDfu0npYt%2F-MaWxFTZk7WP02CUZHaO%2Fimage.png?alt=media\&token=64b0f9a8-4a59-42e3-bd97-bb3f40db3878)

We see 2 links. One leads to a Wordpress webpage and another one is testing which prompt us **Error Establishing Database Connection**.

> Note: We need to add domain name to the /etc/hosts file, since using the IP to access will give us plaintext with no CSS when navigating to the wordpress file.

![http://spectra.htb/main/](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWw1zrtNbaDfu0npYt%2F-MaWxZstHK2w7b-23lRs%2Fimage.png?alt=media\&token=fda9ff35-e38b-41ac-b0ef-00d035c05021)

![spectra.htb/testing/index.php](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWw1zrtNbaDfu0npYt%2F-MaWxbG8w-xGAmOxSA7U%2Fimage.png?alt=media\&token=5b13943a-d638-4e7e-814c-3bee14972ccd)

After poking around, we found out that inside the testing directory we found some interesting files which is **wp-config.php.save**

![Wordpress Config File](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaWyOnMhZ7Fx8uaUCYY%2Fimage.png?alt=media\&token=9a041ad3-5bc3-4baa-ba23-e9fcef171573)

After click inside the **wp-config.php.save**, and open source file, we got tons of configuration information ! One of the useful information which is the database information.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaWz4p1q3OAz6Nz0Zp7%2Fimage.png?alt=media\&token=00e3cef8-5017-4b06-b660-0879270f3947)

Take the password and login to the wordpress admin dashboard.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaWzS3b-2rZyIUI_hZI%2Fimage.png?alt=media\&token=559ca56a-ca43-4866-b2c6-858172cb6791)

We can proceed with getting a reverse shell either using Metasploit or using plugins editor to edit the php file and call the reverse shell.

## Reverse Shell

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX-EHggxt-A-6Jy6aj%2Fimage.png?alt=media\&token=ef0ec8fb-a880-44df-9372-b24976623fbf)

After we get the reverse shell, this is a low level shell and we need to escalate the shell to user shell which is user Katie.

Soon enough we went to **/opt** directories and we saw some directories.

![Files inside /opt](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX04FdKyW6zZklB3Km%2Fimage.png?alt=media\&token=d81bf21d-3e33-4ac9-b7a5-06e637e3314e)

After cat out the **autologin.conf.orig**, we can see there are some codes.

![Code for autlogin.conf.orig](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX0I6U1OCoH5kTZTSG%2Fimage.png?alt=media\&token=282d9139-c0a6-4d27-95c6-6767b39ff199)

What we want to pay attention is the **/etc/autologin** directory.

![Katie's Password](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX0fwpBQ3DGDbQ_7m1%2Fimage.png?alt=media\&token=e1fbff5a-eb9d-4be5-841a-34c960de6b9c)

Walla, got a password, proceed to ssh to user **Katie** since **su** is not allowed :(

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX14yX3N_NkNvuhhZk%2Fimage.png?alt=media\&token=b81101af-7850-4a43-bc83-5ff36d85b794)

## Privilege Escalation

First thing we try **sudo -l** command and wow we got this.

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX1C9_98G5YsFYxp5I%2Fimage.png?alt=media\&token=4db77682-3cec-4614-8328-ba0797ceb509)

Proceed to Google **priv esc /sbin/initctl** and lead us to this Medium [article](https://isharaabeythissa.medium.com/sudo-privileges-at-initctl-privileges-escalation-technique-ishara-abeythissa-c9d44ccadcb9).

What we can do first is to list out all the files that we can inject some codes in it by using command

```
sudo /sbin/initctl list
```

We can see at the end of the line of the output list, we saw test2 file, which is obvious enough to let us inject some codes in it.

![Output of command above](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX2-bnOstG6f7g9Pgu%2Fimage.png?alt=media\&token=23c62cf8-670e-446d-a148-a7cf2c38cf0f)

We can navigate to **/etc/init**

and edit the **test2.conf** file

![Original file for test2.conf](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX2FonKXz9ZEhm3JQ1%2Fimage.png?alt=media\&token=6eeb3962-741c-44e6-9946-209df58db49b)

We can edit the file as follows:

![Injected Script](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX2Y3jEy5XGbEPfX5A%2Fimage.png?alt=media\&token=ba7e47c6-565b-4e4a-b7aa-438e136f210e)

Then we can run the command

```
sudo /sbin/initctl start test2
```

![Test2 process is running](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX2paEo8jH5TaeqtoQ%2Fimage.png?alt=media\&token=93c94dbf-0d58-4205-b647-14b72475ff72)

We can continue supply the command

```
/bin/bash -p
```

![](https://1595701629-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M6jqZqh8dnhmWJDpTuf%2F-MaWxzxN3KfhKsc6QS54%2F-MaX2z8jtq55SrPtC0pJ%2Fimage.png?alt=media\&token=f011fdf3-d7cc-4eb7-b2be-f9e38d580e4c)

Got Root!

Congrats!
