TryHackMe - Dav

Challenge Link : https://tryhackme.com/room/bsidesgtdav
Difficulty : Easy

Full walkthrough video : https://www.youtube.com/watch?v=sGSrnP_CtF8 (includes also the flag)

The challenge I will solve today is called Dav and 2 flags must be found in order to complete it: user flag and root flag.

After turning on the machine, the first step I did was to scan the IP received from TryHackMe. To perform the scan, I used nmap. As you can see below, the results show port 80 as being opened and Apache server running there.

NMAP Scan

I accessed the page but there was nothing interesting or useful because it was just the Apache default page. I took a look at the source code, hoping to find something, but there wasn’t anything. The next step was to begin a scan with gobuster, looking for other available paths. I used small.txt file for this scan and it returned only one result.

Gobuster Scan

Accessing the link I had just found led me to a login portal. Since I hadn’t found any credentials up to that point, I tried some basic default credentials and even attempted some simple SQL injection but it didn’t work. I then started searching for default credentials of what I previously discovered and, after some time, I found the default username and password but also how I can upload files on the webserver.

Get rootshellace’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This rang a bell and made me believe there is a possibility to make use of a reverse shell. I tried to login on the server using cadaver tool and the credentials I had just found and it worked! After, I uploaded a PHP reverse shell.

Cadaver Login

I then started to listen on port 1234 in a different terminal (1234 is the port I set in the PHP reverse shell used) and accessed the file I had just uploaded; I immediately got a reverse shell with www-data user.

Reverse Shell

I went in /home to verify what users are present, I found 2. User flag was found inside one of these 2 users’ home directory. I tried to read the file, it allowed me!

User Flag

I thought I had to focus on lateral movement before obtaining root flag but I tried to see if www-data has any sudo privileges (honestly, I wasn’t too confident). When I checked and saw it didn’t ask for anything and I also have sudo rights to execute /bin/cat, I knew this was solved. I just ran

sudo /bin/cat /root/root.txt

because, usually, root flag is in /root path. And there it was!

Root Flag

Thanks for reading and I hope you enjoyed this walkthrough!