Olympus Writeup

 

Olympus link

Enumeration

Starting off with a nmap scan we can see that we have two ports open, 22(ssh) and 80(http), let's start by taking a look at the web server first.

Looks like we instantly get redirected to olympus.thm so we need to make sure we add this to our /etc/hosts file. Once we get to the website we can see that there is a message letting us know that we can still visit the old version of the website on this domain, so lets run gobuster and see if we can find a directory that will take us there.

Taking a look at the gobuster scan we can see that we have a /~webmaster/ directory so we should go check that out, we can also see that the site is running a mysql db based on the /phpmyadmin/

Looks like we have a pretty basic CMS system, there's some interesting details on this page other than the Admin and Register links, we should probably go look for that wordlist quickly, we can also run another gobuster scan on this directory as well to see if we find anything else interesting.

Taking a quick look around the website reveals that most of the links are dead and there isn't a whole lot else to look at, there is a login field and a search field, the login field seems like it is injectable with a sql authentication bypass attack but doesn't actually redirect anywhere as far as I can tell, it just gets stuck on login.php.

Taking a look at the search field we can see that it is susceptible to sqli, entering a single quote into the field results in the above error and looking at the request details we can see what the post request takes in when we run a search (I've used a 1 in the screenshot just to make it a little easier to see)

I won't go through each and every one of the above images but I just used sqlmap to enumerate the database utilizing the basic sql injection we found, as we can see we get our first flag, we can also find some users and passwords with an email that goes back to chat.olympus.thm which we definitely will want to add to our /etc/hosts file and take a look at, we will also need to crack the password hashes for the users.
We can also see in the chats table there is information about how the system automatically changes file names, this is helpful to know incase we ever need to upload a file to gain a reverse shell.

Taking a look at the chat subdomain we can see that there is a login form, lets go try crack those hashes and see if we can get access with a user.

Running the passwords through john we managed to crack one of them, so lets see what happens when we log in with this account.

Looks like we're in, now we need to find out where these file uploads go.

Running gobuster we can see the uploads directory, navigating their we don't see anything though.

We do receive this message when trying to view the password file that we could see the changed name in the database chat logs, this means if we upload a file, we can at least check the database to see what the file has been changed to.

Checking out the upload.php file we can see that we are told what files we can upload, hopefully we can bypass this filter so that we can upload a reverse shell.

Foothold

Seems like that worked, now all we need to do is open the php file and catch the shell with nc.

And just like that we have a shell, now to upload socat so we can get a stable shell.

Now we can start enumerating the machine and try get to root.

Starting off by navigating to zeus' home directory we can see that we have our user flag which is readable so lets grab that, we also have a text file in there as well.

Nothing overly interesting in here, let's upload linpeas and see if that helps us find anything interesting.

Taking a look at the linpeas output we can see that it flags an unknown binary, let's load it and see what happens seeing it looks like we can run it.

Interesting, looks like we might be able to copy files using this utility, let's see if zeus has an id_rsa file in his .ssh directory and if we can copy it out using this.

Success! Lets head over to the tmp directory and copy this to our machine and see if we can ssh in.

And just like that we're in, now lets see if we can get root.

PrivEsc

Whilst enumerating earlier I stumbled across a directory that only zeus could access, taking a look at this directory it appears there's a reverse shell, lets try navigating to the directory and see what happens.

Success! Now we just need the password from the php file and we should be able to get a reverse shell as root. A note to remember with this one, the directory is in the html directory rather than one of the directories labeled with the domain or subdomain so make sure you use the IP when trying to access the directory.

Following the instructions provided by the shell we easily grab a shell, now to get our root flag and the bonus flag.