DEV Community

Yogeshwar Peela
Yogeshwar Peela

Posted on Originally published at exploitnotes.hashnode.dev

TryHackMe : Athena Writeup

#cybersecurity #tryhackme #ctf #writeup

Overview

Athena is an easy-rated TryHackMe box that chains a leaked internal path
(found via an anonymous SMB share) into a command injection vulnerability in
a "router panel" ping tool, followed by a writable backup script abused via
a systemd service running as a second user, and finished off with a
misconfigured sudo rule that lets that user load an arbitrary kernel
module - in this case a customized build of the
Diamorphine LKM rootkit that grants
instant root via a magic signal.

Recon 

nmap -A -Pn <MACHINE_IP> -o map
Enter fullscreen mode Exit fullscreen mode 
PORT    STATE SERVICE     VERSION
22/tcp  open  ssh         OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp  open  http        Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Athena - Gods of olympus
139/tcp open  netbios-ssn Samba smbd 4
445/tcp open  netbios-ssn Samba smbd 4
Enter fullscreen mode Exit fullscreen mode 
Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: ROUTERPANEL, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
Enter fullscreen mode Exit fullscreen mode

Three services in scope: SSH, an Apache-hosted site themed around the
goddess Athena, and Samba/SMB. The NetBIOS name ROUTERPANEL was an early
hint at what was hiding behind the web app.

Web Enumeration

The homepage (curl http://<MACHINE_IP>/) is a static lore page about
Athena - no obvious functionality, just flavor text and an image.

Directory brute-forcing turned up nothing interesting:

ffuf -u http://<MACHINE_IP>/FUZZ -w /usr/share/wordlists/dirb/big.txt
Enter fullscreen mode Exit fullscreen mode 
.htaccess               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 4348ms]
.htpasswd               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 4346ms]
server-status           [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 57ms]
Enter fullscreen mode Exit fullscreen mode 
whatweb http://<MACHINE_IP>
Enter fullscreen mode Exit fullscreen mode 
http://<MACHINE_IP> [200 OK] Apache[2.4.41], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], Meta-Author[matheuz], Title[Athena - Gods of olympus]
Enter fullscreen mode Exit fullscreen mode

Nothing actionable on the web side by itself - moved to SMB.

SMB Enumeration 

nxc smb <MACHINE_IP> -u guest -p ''
Enter fullscreen mode Exit fullscreen mode 
SMB   <MACHINE_IP>   445   ROUTERPANEL   [*] Unix - Samba (name:ROUTERPANEL) (domain:ROUTERPANEL) (signing:False) (SMBv1:None) (Null Auth:True)
SMB   <MACHINE_IP>   445   ROUTERPANEL   [-] ROUTERPANEL\guest: STATUS_LOGON_FAILURE
Enter fullscreen mode Exit fullscreen mode

Guest failed, but null auth was flagged as supported - tried a blank
username instead:

nxc smb <MACHINE_IP> -u '' -p ''
Enter fullscreen mode Exit fullscreen mode 
SMB   <MACHINE_IP>   445   ROUTERPANEL   [+] ROUTERPANEL\:
Enter fullscreen mode Exit fullscreen mode

Successful anonymous login. Enumerated shares:

nxc smb <MACHINE_IP> -u '' -p '' --shares
Enter fullscreen mode Exit fullscreen mode 
Share   Permissions   Remark
-----   -----------   ------
public  READ
IPC$                  IPC Service (Samba 4.15.13-Ubuntu)
Enter fullscreen mode Exit fullscreen mode

Connected and grabbed the one file on offer:

smbclient //<MACHINE_IP>/Public -N
Enter fullscreen mode Exit fullscreen mode 
smb: \> ls
  msg_for_administrator.txt           N      253  Sun Apr 16 20:54:43 2023
smb: \> get msg_for_administrator.txt
Enter fullscreen mode Exit fullscreen mode 
cat msg_for_administrator.txt
Enter fullscreen mode Exit fullscreen mode 
Dear Administrator,

I would like to inform you that a new Ping system is being developed and I left the corresponding application in a specific path, which can be accessed through the following address: /myrouterpanel

Yours sincerely,

Athena
Intern
Enter fullscreen mode Exit fullscreen mode

An internal note leaking a hidden path - classic case of secrets ending up
on an anonymously readable share.

Finding the Router Panel 

curl http://<MACHINE_IP>/myrouterpanel/
Enter fullscreen mode Exit fullscreen mode