THM - Support

A writeup for “Support” on TryHackMe.

Pentest the Support Ops platform to exploit vulnerabilities and achieve RCE.

The room starts with a brute-force attack against a user account, followed by exploiting an LFI vulnerability that allows us to read internal PHP files on the server. This allows us to also exfiltrate a master password from the config file.

After that, we can abuse an IDOR vulnerability within the unlocked user API to obtain the email address of the admin account. Combining this email with a mutated version of the password obtained through LFI allows us to log in as admin.

Once inside, we can abuse the date/time feature via command injection to achieve remote code execution on the server and capture the final flag.

https://tryhackme.com/room/support

Disclaimer

The content of this article is for educational purposes only. Do not use the techniques described here on any system without the explicit consent of the owner.

Footprinting

Nmap scan

We can start by doing a scan with nmap.