> TryHack3M: Bricks Heist (TryHackMe)
Before beginning we need to edit our /etc/hosts file which makes it easier to use the target machine during scanning and exploitation phases.
The /etc/hosts file serves as the first source of hostname-to-IP address mappings before accessing the DNS servers.
sudo vim /etc/hosts
Thereby if we include our attackbox IP as bricks.thm whenever we access https://bricks.thm in our we browser the atttackbox IP is mapped accordingly.
Reconnaissance
Nmap
We will begin the box by setting up an nmap scan to identify the vulnerable services running on the ports.
nmap -sC -sN -oN initialNmap <TARGET-IP>
-sC → Default script scanning
-sN → This flag specifies a TCP NULL scan. This technique is used to determine whether the ports are open, closed, or filtered by observing the response behavior of the target system.
-oN → Instructs Nmap to save the output by this file name
The output of this scan does not help us much.
When we access the site using our web-browser this is what we receive.
Once we access the source code there are a few lines to keep note of :
Line 33 (Indicates wordpress content)
Line 41 (Version of wordpress is denoted)
I have also tried the nikto scan and directory busting using gobuster and FFUF which proved to be of not much use.
WPS Scan
Once we access the webpage using https://<TARGET-IP> we can view the image and inspect the websites source code, we will soon discover that the website contains elements of WordPress. Using this hint we can scan the website for any wordpress vulnerabilities using WPScan. This tool ensures
wpscan --url https://<TARGET-IP> --disable-tls-checks (WPS Scan)
From this we can identify that the theme run in this wordpress site is known as bricks (Bricks version 1.9.5) We can now find an exploit for this vulnerability.
Exploitation
For the exploit we can try
metasploit or we can do it manually which i found was easier, hence the manual
version is specified.
wget
https://github.com/Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress
or
git
clone
https://github.com/Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress
Don't forget to download the
requirements as well to run this exploit without fail.
python
exploit.py -u http://bricks.thm
Once we run this we can easily obtain a shell from which we can access the information.
1) What is the content of the hidden .txt file in the web folder?
Once we get into the reverse shell we can ls to find the documents and access this file to obtain the first flag.
cat 650c844110baced87e1606453b93f22a.txt
2) What is the name of the suspicious process?
By using systemctl we can investigate the processes running in the system, we can further filter the results to find out which services are running using.
Here we find a process named ubuntu.service, which runs a process named nm-inet-dialog
We can investigate the contents of this file using
systemctl -list-units --type=service --state=running
systemctl cat ubuntu.service (Because this is by TRYHACK3M)
nm-inet-dialog
3) What is the service name affiliated with the suspicious process?
From the previous point we found out the service name as ubunut.service
4) What is the log file name of the miner instance?
We can access the contents of the log file by using :
ls /lib/NetworkManager/
cat /lib/NetworkManager/inet.conf
This shows a list of all the miner instances which are stored in the log file.
5) What is the wallet address of the miner instance?
The wallet address can be found, in this log file as well. But this does not work. We can put this onto Cyberchef and magic-wand to find what is hidden in the cipher text.
Press the magic wand icon to get the following output
bc1qyk79fcp9hd5kreprce89tkh4wrtl8avt4l67qabc1qyk79fcp9had5kreprce89tkh4wrtl8avt4l67qa
This address needs to be further identified a quick google search will do the trick.
By doing so we understand that this is a bc1 bitcoin address.
In these types of addresses we have the Human Readable Part (HPR) which is the bc1 & the data part which is qyk79fcp9hd5kreprce89tkh4wrtl8avt4l67qa. This data part contains the encoded information necessary for the Bitcoin transaction, including the witness version, hash, and checksum.
However we have 2 bc1 codes you can try the first one as the miner address
bc1qyk79fcp9hd5kreprce89tkh4wrtl8avt4l67qabc1qyk79fcp9had5kreprce89tkh4wrtl8avt4l67qa
6) The wallet address used has been involved in transactions between wallets belonging to which threat group?
The wallet address belonging to the threat group can be identified by the following:
Head over the blockchainexplorer and paste in the transaction address and investigate the transaction.
Here we have a list of transactions from which we assume that they require us to check the last transaction.
Once we find the address from which the last transaction came from we can copy that address and run a google search to identify who is behind the transaction.
From here click on the link (Cyber-related), by doing so we can access the name of the group behind it as LockBit.
With that we are now officially done with this box.
Key points
- Identifying WordPress vulnerabilities using Wpscan
- Running manual exploits
- Bitcoin address formats (Bech32)
- Extracting necessary information using command: systemctl
> If any part was of confusion, don't hesitate to comment below !
Hopefully, you all gained some knowledge by reading my article.
## ADIOS AMIGOS ##
Comments
Post a Comment