Inclusion writeup — THM

Figure 1.1 (Banner)

Introduction:

This is my Documentation for Inclusion room in TryHackMe. This room is about Local File Inclusion.

Link: https://tryhackme.com/room/inclusion

Resources used:
Kali VM
Nmap
Ssh
GTFObins

Enumeration:

nmap -sC -sV 10.10.205.74

Figure 1.2

From the scan results, we can derive that 2 services are running:
1. 22 (SSH) (OpenSSH)
2. 80 (HTTP) (Werkzeug httpd)

Web Recon:
Let’s poke at the Webserver and see it’s contents.

Figure 1.3

Let’s explore the pages of this web app and here we found a place from where we check about LFI vulnerability as show in image below:

Figure 1.4

Change the value in name parameter from “hacking” into “../../../etc/passwd”

http://10.10.205.74/article?name=../../../etc/passwd

This shows the LFI is possible on this web app but as I was carefully reading the output, the username and password of ssh as shown in figure below:

Figure 1.5

Now let’s try to connect with this machine using ssh with credentials we got from web app.

ssh falconfeast@10.10.205.74

Figure 1.6

Now let’s find the user flag.

ls -al

We have successfully found user.txt/user flag as show in image below:

Figure 1.7

Now let’s find a way to get our root privilege. To check privileges of current user enter following command sh shown in image below:

sudo -l

Figure 1.8

We came to know that with we can run socat with root privileges on falconfeast user. Now let’s use a shell escape we got from https://gtfobins.github.io/gtfobins/socat/

Figure 1.9

sudo socat stdin exec:/bin/sh

Figure 1.10

Now we have root user. Let’s find the root flag in /root directory.

Figure 1.11

Finally! We have completed the Inclusion room. Thanks for reading my writeup! :)