Walkthrough: TryHackMe Recruit

Recruit has just launched its new recruitment portal, allowing HR staff to manage candidate applications and administrators to oversee hiring decisions. While the platform appears functional, management suspects that security may have been overlooked during development. Your task is to assess the application like a real attacker, mapping its structure, abusing exposed functionality, and exploiting vulnerabilities.

Can you gain an initial foothold, escalate your access, and ultimately log in as the administrator?

Initial Access: Run an Nmap scan to see if there are open ports.

Here’s a breakdown of the command:

• -sS →TCP (stealth) scan is a popular scan option as it can scan thousands of ports quickly. This scan sends SYN packets and analyzes responses without completing the TCP handshake. Though this is a stealth scan, it is still detectable.
• -vv → Very vebose. Nmap will print more information about the scan in progress.
• -p- → For scanning all 65,535 ports.
• -A → Agressive scan. Enables OS and version detection.
• For more information on nmap, check out https://nmap.org/book/man.html.

Nmap gives the following output:

Gobuster

Open a second terminal tab and run the following:

gobuster dir -u http://10.144.144.177 -w /usr/share/wordlists/dirb/common.txt

Here’s a breakdown of the command:

• gobuster dir → DIR mode enumerates hidden directories and files on web servers.
• -u → Target URL
• -w → Wordlist to use. Don’t forget your path!
• For more Gobuster fun, check out https://github.com/OJ/gobuster.

Poke Around

Interesting looking directories may give valuable information, such as usernames. There’s an interesting file the mail directory:

This email reveals a username:hr, and that the credentials are stored in a config.php file. Administrator credentials are stored in the backend database. Time to find the password.

Local File Inclusion

10.144.144.177/file.php?cv=file://config.php

Now login! I find the first flag, and have a foothold.

Privilege escalation time!

Note the search bar. Perhaps there is a database vulnerable to SQL injections. I enter a single quote to test, and the server returns an error response, confirming the SQL vulnerability.

My first thought after this error was to test another payload: search=’ OR ‘1’=’1' —

I made the mistake of running through all types of SQL payloads (which didn’t work), when the information I needed was right in front of me. If I did this challenge again, I would pay attention to the fact that there are four columns and four rows in the table. I’d confirm this with a payload.

' union select 1,2,3,4-- -

But, after much experimenting with payloads, I finally ran:

This gives the password to login and retrieve the final flag.

You can speed up this challenge by using BurpSuite, TryHackMe’s intention for this challenge is to teach SQL Injections. I did learn a lot by experimenting with different payloads.