The Trial Before Christmas
Web
Video
Resources
Challenges
Scan the machine. What ports are open?
nmap -sC -sV -T5 -p1-65535 10.10.243.219
80, 65000
What's the title of the hidden website? It's worthwhile looking recursively at all websites on the box for this step.
Light Cycle
What is the name of the hidden php page?
uploads.php
What is the name of the hidden directory where file uploads are saved?
grid
Bypass the filters. Upload and execute a reverse shell.
No answer needed
What is the value of the web.txt flag?
THM{ENTER_THE_GRID}
Upgrade and stabilize your shell.
No answer needed
Review the configuration files for the webserver to find some useful loot in the form of credentials. What credentials do you find? username:password
tron:IFightForTheUsers
Access the database and discover the encrypted credentials. What is the name of the database you find these in?
tron
Crack the password. What is it?
@computer@
Use su to login to the newly discovered user by exploiting password reuse.
No naswer needed
What is the value of the user.txt flag?
THM{IDENTITY_DISC_RECOGNISED}
Check the user's groups. Which group can be leveraged to escalate privileges?
lxd
Abuse this group to escalate privileges to root.
No answer needed
What is the value of the root.txt flag?
THM{FLYNN_LIVES}
Last updated
Was this helpful?