Wonderland
This is my write-up for the TryHackMe machine called Wonderland located at: https://tryhackme.com/room/wonderland.
I started off by running an nmap scan:
sudo nmap -sV -sC -O -n -oA nmapscan 10.10.91.174
There seems to be 2 ports open. Following port 80 leads me to the following:
There does not seem to be a robots.txt file on the system:
I then ran feroxbuster on the IP address:
feroxbuster -u http://10.10.91.174 -x pdf,js,html,php,txt,json,docx -w /usr/share/wordlists/dirb/common.txt -t 30
I noticed that there was a pattern here:
I looked at the man page for feroxbuster and found that a recursion depth of 0 is infinite. Although it seems like the word from each directory would form rabbit, I still wanted to make sure. This was my updated command:
feroxbuster -u http://10.10.91.174 -x pdf,js,html,php,txt,json,docx -w /usr/share/wordlists/dirb/common.txt -t 30 -d 0
This led to a page:
I viewed the source code of this page and found the following:
This seems to be maybe an SSH account. It was:
There were two files, and both were owned by root:
Running sudo -l
, I saw the following:
It seems that I can run sudo, but as rabbit:
I have to find a way to switch over to rabbit, using this access. I was thinking I can maybe over-write the file and change the content of the file itself. I then found this write-up https://github.com/Slowdeb/Tryhackme/blob/main/Wonderland.md that mentioned that I had missed the user.txt in the root directory. Sure enough, I had:
However, I was still stuck as to how I would escalate my privileges. I had tried modifying the python script and modifying the python3.6 file on the system, and was not able to do either. The same previous walkthrough led me to this post: https://medium.com/analytics-vidhya/python-library-hijacking-on-linux-with-examples-a31e6a9860c8. This was about Python library hijacking. In the python code, there is only one import:
The same write-up ended up making a local file called random.py and entered the following into it:
I then realized that the original python code might be referencing locally AND THEN referencing the alternate location (/usr/lib/python3.6/random.py).
We are now the user rabbit. I look in the home directory of rabbit and find an executable called teaParty. I ran the code, and it seems to have the sleep command incorporated in it:
I wanted to know what the code did, so I copied the code from rabbit's directory into the /tmp directory. I then used FileZilla with alice's login and downloaded the file to my local system. I then used strings to see what was in the file:
I had to go back to the previous write-up again. I learned that the date command is not using the absolute path. As the author did, I entered the following into a file called date:
I made and edited the file in alice's home directory. I then copied it over to the /tmp folder, where I then used my access to rabbits account to grab it from there. I also had to update the PATH to then make the SUID binary read from the date file we had made. Here are the commands I had run after I moved the date file to rabbits home folder:
chmod +x date #to make date executable
export PATH=/home/rabbit/:$PATH #to make the system recognize the path we have access to
./teaParty #run the binary
I then had access to hatter:
There is a password file in hatter's home directory:
The password was for the hatter user. I then ran find / -type f -perm -04000 -ls 2>/dev/null
to see what executables I had access to. I saw the following, where one had stuck out to me:
There was a major vulnerability in pkexec that allows you to get root. I used the code from https://github.com/ly4k/PwnKit/blob/main/PwnKit.sh to download the exploit on my own machine. I then used FileZilla to transfer that exploit to the hatter home directory. From there, I was able to make it executable and get root:
I was then able to get the root.txt file as well:
Lessons Learned: I learned a couple of main things while working on the box. The first error I made was not understanding that if root.txt was in a users home directory, that user.txt might have been in the root directory. The first thing I had learned was Python imports and how they check locally for the import before looking in the library folder. Another item I learned was about SUID binary exploiting by manipulating the PATH variable.
Last updated