TryHackMe - Tempus Fugit Durius
Nmap
Enumeration
HTTP
Checking Port 80, shows the following page:
Gobuster
I tried to run gobuster but everything returns a 200 OK, so time to do some manual enumeration.
Checking the Upload Page
I tried uploading a PHP web shell, but it failed.
The application states that it only accepts txt and rtf files.
Uploading a TXT file
Based on the upload message, I can see that the application reads the content of my TXT file.
Checking Possible RCE
This time, I upload the same TXT file, but I add the command id to see what happens.
And that worked.
Exploit
Trying to get a shell with netcat was a bit of a hit and miss. Every time, I tried something different, I got a message saying the file name was way too long.
After some research and a lot of failed shell execution, I managed to get a shell using my IP addresses encoded in hex.
My code to get a shell
If you try that on your our Kali machine, you can see that bash interprets the IP address in hex and it works fine. The reason for the a.txt at the end was due to the file filter which only allows TXT and RTF.
Code Research
Only allows TXT and RTF
And here is why the IP address was failing...
Privilege Escalation
We find some creds under the /app directory which allows us to login as root.
Last updated