Post cover image
Support THM — Exploiting LFI, Weak Session Cookies, and Command Injection

July 18, 2026

[Support] — Exploiting LFI, Weak Session Cookies, and Command Injection

From web enumeration to full compromise by chaining authentication flaws, LFI, and command injection.

By Bash Overflow

5 min read

🔓 Free Link

Table of Contents

  1. Overview
  2. Reconnaissance Uncovers the Initial Attack Surface
  3. Breaking Authentication Through Weak Session Trust
  4. Exploiting LFI to Reach Password Access
  5. Turning a Date Utility into Command Injection

Overview

The assessment begins with reconnaissance using Naabu and Nmap, revealing only two exposed services: SSH (22) and HTTP (80). Web enumeration then uncovers several interesting resources, including an info.php file that provides valuable information about the application's environment.

The next stage targets the application's authentication mechanism. A successful brute-force attack with Hydra against the help@support.thm account provides initial access. After authentication, analysis of the session cookie reveals a weak MD5-based implementation where a privilege-related value is set to false. Modifying this value to true results in privilege escalation to the ITAdmin account.

With elevated privileges, further enumeration exposes administrative functionality and reveals a Local File Inclusion (LFI) vulnerability through the theme customization feature by abusing the ../config path. Sensitive configuration data, including administrative credentials, can then be extracted. Although the recovered password initially fails with an Invalid Credentials error, removing the @ character from the password allows successful authentication as the administrator.

Finally, administrative access exposes a feature that executes the date command. Because user input is passed directly to the underlying system command without proper sanitization, the functionality is vulnerable to command injection, allowing arbitrary command execution and retrieval of the final flag.

Reconnaissance Uncovers the Initial Attack Surface

  • As with most TryHackMe labs, start by adding the target to your local /etc/hosts file.
<target_ip> support.thm
  • Begin with service enumeration using Naabu and Nmap.
$ naabu -Pn -top-ports full -host support.thm

$ nmap -Pn -p 22,80 -sV -sC -T4 support.thm
Image 1 — Support THM Walkthrough Image 2 — Support THM Walkthrough
  • The scan reveals that HTTP (80) is accessible, so the next step is to inspect the web application from the browser.
Image 3 — Support THM Walkthrough
  • Continue with directory and file enumeration using ffuf, including the .php extension.
$ ffuf -u http://support.thm/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 0 -ac -e .php
Image 4 — Support THM Walkthrough
  • Several interesting files are discovered, including info.php. However, opening it only exposes the default PHP Info page, which does not immediately provide sensitive information.
  • The next challenge is the login page. At first, I was unsure which username to target for brute force, but the login form itself provides a useful hint by displaying the email address help@support.thm.
$ hydra -l help@support.thm -P /usr/share/wordlists/rockyou.txt http-post-form://support.thm/":email=^USER^&password=^PASS^:Invalid credentials" -f -V -t 10
Image 5 — Support THM Walkthrough
  • After recovering the correct password, I logged into the application dashboard.
Image 6 — Support THM Walkthrough

Breaking Authentication Through Weak Session Trust

  • While exploring the dashboard, I noticed a feature that allows users to change the application skin. This immediately suggested the possibility of a directory traversal attack.
http://support.thm/dashboard.php?skin=red
Image 7 — Support THM Walkthrough
  • I experimented with several payloads and wordlists, but none of them produced useful results or leaked any files.
  • At this point, I switched to Burp Suite and simply refreshed the dashboard page to inspect the HTTP traffic more closely.
  • One cookie immediately stood out: isITUser.
Image 8 — Support THM Walkthrough
  • The cookie value matched the format of an MD5 hash, so I attempted to identify it using CrackStation.
Image 9 — Support THM Walkthrough
  • The hash was successfully resolved to the value: false
  • Since the application appeared to rely solely on this value for authorization, I replaced it with the MD5 hash of true.
true -> b326b5062b2f0e69046810717534cb09
  • After replaying the request through Burp Suite, I successfully gained access to the IT Admin Panel.
Image 10 — Support THM Walkthrough

Exploiting LFI to Reach Password Access

  • The new privileges expose an additional endpoint:
http://support.thm/api.php
Image 11 — Support THM Walkthrough
  • While exploring the API, I noticed what appeared to be an Insecure Direct Object Reference (IDOR) vulnerability.
  • After testing the endpoint, I confirmed that user enumeration was possible, allowing me to retrieve information about the Admin account.
Image 12 — Support THM Walkthrough
  • With the administrator's email address in hand, I attempted another Hydra brute-force attack against the login form. Unfortunately, no valid credentials were recovered.
  • I then revisited the Change Skin functionality. This time, I combined it with one of the files discovered during directory fuzzing and eventually identified a Local File Inclusion (LFI) vulnerability that exposed the administrator's credentials.
Image 13 — Support THM Walkthrough
  • I tried logging in using the recovered Admin email address and password, but the application consistently returned an Invalid Credentials error.
Image 14 — Support THM Walkthrough
  • Even after repeating the login several times and verifying the extracted password, the result remained the same. At this point, the attack path appeared to be a dead end.
Image 15 — Support THM Walkthrough
  • This stage consumed the most time during the assessment. After experimenting with multiple ideas, I eventually noticed that removing the @ character from the extracted password allowed the authentication to succeed.
  • Once logged in as Admin, I obtained the first flag.

What is the flag value after logging in as admin?

Image 16 — Support THM Walkthrough

Turning a Date Utility into Command Injection

  • I revisited the API endpoint:
http://support.thm/api.php
  • As an administrator, a new feature becomes available for displaying the current system time, a functionality that was not accessible from the standard user account.
Image 17 — Support THM Walkthrough
  • I captured the request with Burp Suite and tested it for command injection. The input was passed directly to the underlying system command, making the endpoint vulnerable to arbitrary command execution.
Image 18 — Support THM Walkthrough
  • Finally, I leveraged the command injection vulnerability to read the contents of /home/ubuntu/user.txt and retrieve the final flag.

What is the content of the file /home/ubuntu/user.txt?

Image 19 — Support THM Walkthrough

📢 Enjoyed this post? Stay connected! If you found this article helpful or insightful, consider following me for more:

🙏Your support is appreciated.

Latest Cybersecurity News, Vulnerabilities, and Technical Analysis Stay updated with the latest cybersecurity news, discover vulnerabilities, and explore technical analysis in our lab…