CTF: Expose TryhackMe Room

Get the Shell

Scanning with Nmap:

I check ftp-anon but nothing worth. Then I think I should check the http server. Using ffuf to brute-force sub directory then I found out /phpmyadmin/

I will brute-force its credential(pma_username, pma_password, server=1).

Unfortunately it doesn't work. I try to fuzz the directory again with a bigger wordlist. Then I found a new one (admin_101). There are many sub dir and file and I got stuck here. I read the instruction and try sqlmap. I got a new file path with a hopefully LFI.

There is a HINT in the source page. Lets try.

Now I need an upload file. Look up again the sqlmap result. I have another file path /upload-cv00101011/index.php (password is zeamkish — found in /etc/passwd)

I will use burp-suite to intercept traffic and modify the file upload. I create a php reverse shell. Change its extension to .php.png. Then I upload it and turn intercept on, change it to .php again and forward. Upload file path is leaked in response page.

SSH Shell

After getting the shell. I found a ssh credential of user zeamkish.

User's flag: THM{USER_FLAG_1231_EXPOSE}

Root Privilege Escalation

I find some misconfigured SUID binary. (find / -type f -perm -4000 -ls 2>/dev/null)

Check GTFOBins for SUID "find" binary.

Root's flag: THM{ROOT_EXPOSED_1001}