TryHackMe: Poolside Writeup

From NoSQL Injection & SSTI to Raw Disk Root Access via Debugfs

Introduction
Welcome to this detailed technical walkthrough for the Poolside room on TryHackMe. This machine presents an engaging web exploitation challenge that starts with an authentication bypass, moves into remote code execution, and culminates in an unconventional privilege escalation vector utilizing raw disk analysis via system utilities and Node.js debugging.

Phase 1: Initial Reconnaissance & Scanning
We begin our engagement by performing a port scan using Nmap to identify open ports and running services on the target machine:

nmap -sV -sC 10.67.180.45

Nmap Scan Results:

Port 22/tcp (SSH): OpenSSH 9.6p1 Ubuntu.
Port 80/tcp (HTTP): Node.js (Express middleware) hosting a web application titled “Byte Lotus — Poolside”.
To discover hidden directories and endpoints on the web server, we run a directory brute-force enumeration using Gobuster

gobuster dir -u http://10.67.180.45 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

The directory scan reveals key endpoints such as /staff (returning a 403 Forbidden status code requiring authentication) and /logout.

Phase 2: NoSQL Authentication Bypass
The login portal on port 80 prompts for a Staff/Guest ID and a Passphrase. By intercepting the login POST request using Burp Suite, we notice that the backend framework relies on Express.js, strongly suggesting a NoSQL (MongoDB) database backend. Standard SQL injection payloads fail, but NoSQL operators provide an elegant bypass. By leveraging MongoDB’s “not equal” operator ($ne), we can manipulate the query logic:

POST /login HTTP/1.1
Host: 10.67.180.45
Content-Type: application/x-www-form-urlencoded
username=attendant&password[$ne]=wrong
This payload alters the backend database query structure to check if the password is not equal to “wrong”, which evaluates to true for the valid username attendant. The server responds with a 302 Found redirect and sets an authentication cookie (connect.sid), granting us entry to the staff console at /staff.

Phase 3: Server-Side Template Injection (SSTI) & Initial Shell
Inside the staff console, we find a booking confirmation message customization feature that utilizes EJS (Embedded JavaScript) templates. Entering a mathematical expression like <%= 6 * 4 %> into the preview renders 24, confirming a severe Server-Side Template Injection (SSTI) vulnerability.

We can exploit this template injection to execute arbitrary system commands via Node.js child process modules. To gain a stable reverse shell, we inject a standard Node payload executing a Python reverse shell back to our attack machine:

By setting up a Netcat listener on our machine (nc -lvnp 7777) and triggering the preview panel, we successfully catch a reverse shell as the user poolside. Navigating to the user's home directory reveals our first flag:

poolside@tryhackme-2404:~$ cat user.txt
THM{......................}
Phase 4: Privilege Escalation & Raw Disk Access
Standard privilege escalation enumeration reveals no straightforward sudo permissions or explicit SUID binaries. However, examining internal system processes and capabilities shows that a background Node process running under another user has access to disk utilities and low-level system interaction.

Specifically, we can use Node.js to execute administrative binaries capable of interacting with block devices. Using debugfs against the primary disk partition (/dev/nvme0n1p1), we can bypass standard file permission restrictions enforced by the operating system because we have raw block device read capability or interface access.

Let’s inspect the contents of the root directory using debugfs via Node execution:

process.getBuiltinModule(‘child_process’).execFileSync(‘/usr/sbin/debugfs’, [‘-R’, ‘ls /root/’, ‘/dev/nvme0n1p1’], { encoding: ‘utf8’ })

The output reveals the contents of /root, including root.txt. We can then read the root flag directly through debugfs:

process.getBuiltinModule(‘child_process’).execFileSync(‘/usr/sbin/debugfs’, [‘-R’, ‘cat /root/root.txt’, ‘/dev/nvme0n1p1’], { encoding: ‘utf8’ })

Root Flag Retrieved: THM{..........................}

Conclusion
The Poolside room is an exceptional machine that highlights the dangers of insecure NoSQL query handling, the catastrophic impact of Template Injection in Node.js applications, and how misconfigured system permissions or raw block device access (debugfs) can completely undermine Linux file system security boundaries.

Thank you for reading! If you enjoyed this write-up, feel free to share it with the community and leave a clap on Medium. Happy hacking!