I am solving a machine on tryhackme this time called elFIn
let’s start with scanning as usual
Nmap scan
Only 2 ports were open ssh and the default web port
From the machine’s name it’s obvious that the machine is vulnerable to LFI (Local File Inclusion) some google search will be good to understand what LFI is if you don’t know it
Now let’s find a parameter in the web to abuse
list parameter
As we can see there is a parameter called list which allows us to go from page to another
I tried changing page1 to LFI payload and here is what i got :D
It looks like a base64 encryption let’s decrypt it
page source
And here we are with the full page source
While checking the php code we can see that the server accepts a variable called “src” and add .php extension by adding one of the accepted parameters then the path to etc/passwd we should be able to read it let’s try
after some enumerating I found this hidden directory /var/www/.secret which has a file named priv.sh runs all the time and we can edit it…. could be useful if we can run it as root I checked the crontab and was it was scheduled to run priv.sh as user bob
cat /etc/crontab
/etc/crontab
I added a this rev shell in the priv.sh file to get a shell as user bob and ran a listener in other terminal
