TryHackMe | Support Write-Up

This machine is for more experienced web application security testers and can be found here: https://tryhackme.com/room/support

add support.thm to your /etc/hosts file.

GNU nano 9.2                                      /etc/hosts                                                
127.0.0.1       localhost
127.0.1.1       kali  

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes  
ff02::2 ip6-allrouters

10.64.166.20 support.thm

Nmap reveals 2 ports open on this machine

nmap -Pn -n -T5 -vvv -p- support.thm
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-05 00:41 -0500
Initiating SYN Stealth Scan at 00:41
Scanning support.thm (10.64.161.75) [65535 ports]
Discovered open port 22/tcp on 10.64.161.75
Discovered open port 80/tcp on 10.64.161.75
Warning: 10.64.161.75 giving up on port because retransmission cap hit (2).
SYN Stealth Scan Timing: About 21.87% done; ETC: 00:43 (0:01:51 remaining)
SYN Stealth Scan Timing: About 44.62% done; ETC: 00:43 (0:01:16 remaining)
SYN Stealth Scan Timing: About 65.97% done; ETC: 00:43 (0:00:47 remaining)
Completed SYN Stealth Scan at 00:43, 157.08s elapsed (65535 total ports)
Nmap scan report for support.thm (10.64.161.75)
Host is up, received user-set (0.059s latency).
Scanned at 2026-10-05 00:41:14 EST for 157s
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE REASON

22/tcp open  ssh     syn-ack ttl 62
80/tcp open  http    syn-ack ttl 62

support.thm/ takes us to an apache2 Ubuntu default page.

After a quick directory scan it reveals a few .php pages.

feroxbuster -u http://support.thm --force-recursion -C 500,400,404 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt --no-state -x .php
                                                                                                                                         
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://support.thm/
 🚩  In-Scope Url          │ support.thm
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt
 💢  Status Code Filters   │ [500, 400, 404]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
 🤘  Force Recursion       │ true
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      273c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       28w      307c http://support.thm/js => http://support.thm/js/
302      GET        0l        0w        0c http://support.thm/api.php => index.php
200      GET        0l        0w        0c http://support.thm/config.php
200      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       28w      313c http://support.thm/includes => http://support.thm/includes/
301      GET        9l       28w      310c http://support.thm/skins => http://support.thm/skins/
200      GET       92l      176w     2591c http://support.thm/index.php
200      GET       92l      176w     2591c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       92l      176w     2591c http://support.thm/
301      GET        9l       28w      311c http://support.thm/layout => http://support.thm/layout/
302      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      821l     4368w    73262c http://support.thm/info.php
200      GET        3l        7w       56c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      825l     4384w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       38l       66w     1253c http://support.thm/footer.php
200      GET       38l       66w     1253c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       16l       58w      952c http://support.thm/layout/
200      GET       89l      438w    15534c http://support.thm/info.php/2010.php
200      GET      491l     2249w    45842c http://support.thm/info.php/view

/index.php takes us to a login screen with the email ‘help@support.thm’.

I captured the login request with Burp Suite Repeater and tested the application for rate limiting. Since there was no restriction on repeated failed login attempts, I proceeded to brute-force the password for help@support.thm.

The brute-force attack successfully revealed the password for help@support.thm as snoopy. After logging in, we are redirected to dashboard.php, where a Select Theme feature is available.

After testing the API, the server returned an Access Denied response. I then examined the session cookie and identified it’s value as an MD5 hash.

Cracking the hash revealed the plaintext value false.

I generated the MD5 hash of true and replaced the original cookie value with it. After sending the modified request, I was granted admin privileges, allowing me to access the previously restricted API.

We can now see an option to view the api.php page from dashboard.php. The API page reveals that we can query information about other users through the /user/ endpoint.

Sending a GET request to support.thm/user/1 reveals the administrator's email address but we still need the password to authenticate.

Admin Flag

We could create a custom wordlist containing words found on the website and a range numbers to brute-force the password but there is a more direct approach. We can use the ?skin= to read config.php fileand retrieve the password stored within it.

The skin endpoint is vulnerable to Local File Inclusion (LFI), allowing us to read the source code of config.php fileusing:

?skin=../config

The server includes the requested file without requiring the .php extension. The same behavior is present on the api and index endpoints.

Get Sean Knight 🇯🇲’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Reading the source code reveals the master password as support@110. However, this is not the correct password. Removing the @ from the password gives us support110, which can be used to authenticate as specialadmin@support.thm and obtain the admin flag.

Ubuntu User Flag

After logging in, we can see a new feature beside the Select Theme option called Date. Clicking it also reveals a Time option. The feature appears to retrieve the date and time from the server and output it onto the webpage using sys=date+.

By escaping the command with ; and executing commands such as whoami or id using Burp Suite Repeater, we can confirm that the application is vulnerable to Remote Code Execution (RCE). We can then read the user flag from the Ubuntu user's home directory using:

sys=date+<snip>; cat /home/ubuntu/user.txt

I hope you find this walkthrough helpful in completing the room! If you are still struggling feel free to message me on Instagram and I will try my best to assist!