Backtrack TryhackMe Walkthrough | Medium Room

Summary of Technological Concepts, Product Features, and Analysis

Video Topic: Walkthrough of a Medium difficulty room on TryHackMe using Backtrack Linux, focusing on exploiting vulnerabilities to gain root access.

---

Key Concepts and Steps Covered:

• Initial Reconnaissance:
  • Use of Nmap with default scripts (-sV) and aggressive timing (-T4) to scan ports 1-10000.
  • Identification of open ports: SSH (22), HTTP (6800), Apache Tomcat (8080), and an unknown service on port 8888.
• Web Service Enumeration:
  • Discovery of Apache Tomcat 8.5.93 running with a manager app requiring credentials.
  • Accessing the unknown web UI on port 8888 revealing software version info.
  • Searching for exploits based on version info, finding a CVE-2023-39141 path traversal vulnerability.
• Path Traversal Exploit:
  • Using curl with specific flags to exploit the WebDAV path traversal vulnerability to read sensitive files like /etc/passwd.
  • Locating Tomcat credentials in /opt/tomcat/conf/tomcat-users.xml.
• Tomcat Manager Exploit:
  • Attempt to login to Tomcat manager app using found credentials (access denied to GUI).
  • Using CLI to upload a reverse shell JSP payload generated with msfvenom.
  • Establishing a reverse shell connection as the Tomcat user.
• Privilege Escalation via Ansible Playbook:
  • Enumerating user permissions, discovering the user willber can run Ansible Playbook without a password.
  • Creating and executing a malicious Ansible Playbook (shell.yml) to escalate privileges to willber.
  • Accessing flags and user files in willber’s home directory.
• SSH Port Forwarding and Local Web App Testing:
  • Finding credentials for user orille in a text file.
  • Using SSH local port forwarding (ssh -L) to access a locally running web app.
  • Attempting to login and test file upload functionality.
• File Upload Vulnerability:
  • Testing file upload restrictions on the web app.
  • Bypassing file extension checks by double encoding the file name to upload a PHP reverse shell.
  • Discovering PHP execution is disabled in the upload directory (php_flag engine off), preventing direct shell execution.
• Bypassing PHP Execution Restriction:
  • Uploading the shell to the root directory using path traversal in the upload endpoint.
  • Gaining shell access as user orille.
• Post-Exploitation Enumeration:
  • Uploading pspy64 (process monitoring tool) via Python HTTP server to monitor running processes.
  • Discovering a user switching to orille without a password and an opportunity for TTY shell upgrade.
• TTY Pushback Exploit for Root Access:
  • Explanation and demonstration of the TTY pushback technique to escalate from user shell to root.
  • Uploading and executing a Python script that modifies permissions of bash to setuid root.
  • Gaining root shell and accessing the root flag.

---

Tools and Techniques Demonstrated:

• Nmap for port scanning and service enumeration.
• Curl for exploiting path traversal.
• msfvenom for generating Java reverse shell payloads.
• Tomcat Manager CLI upload for deploying shells.
• Ansible Playbook exploitation for privilege escalation.
• SSH port forwarding to access local services.
• File upload vulnerability exploitation with bypass techniques.
• Python HTTP server for file transfer.
• pspy64 for process monitoring.
• TTY pushback exploit for root escalation.

---

Tutorial/Guide Highlights:

• Step-by-step exploitation of a multi-stage hacking challenge.
• Practical demonstration of using public exploits and combining vulnerabilities.
• Explanation of privilege escalation via misconfigured Ansible and TTY shell tricks.
• Bypassing common web application security controls (file upload restrictions, PHP execution disabling).
• Use of various Linux commands and scripting to automate exploitation.

---

Main Speaker/Source:

• M SEC (YouTube channel or individual) conducting the walkthrough and tutorial.

---

Overall, the video provides a comprehensive, practical guide to exploiting a medium-level TryHackMe room using Backtrack, focusing on vulnerability chaining, privilege escalation, and root access techniques.