Chocolate Factory writeup(tryhackme)

The link for this machine is:https://tryhackme.com/room/chocolatefactory

So, as usual i started with nmap scan , but it was taking too long so I started enumeration before nmap results. I went to the machine’s IP and found a web page with a login form and then I started enumerating directories using Gobuster .

command= gobuster dir -u HTTP://IP/ -w (wordlist with full path) -x PHP,txt

and I found a home.php

As you can see i have shown the gobuster and IP/home.php results.

We see a command option there and it looks like we can execute commands and i did .

command = ls

After this command , we found a key_rev_key and we cat (command for printing the contents of a file) out the file

Now, we have found the key and we know there is a command execution vulnerability so let’s get a reverse shell now.

I prefer pentestmonkey as it has a lot of reverse shells and i used a PHP one.

Remember to change the IP for reverse shell

and start a netcat listener on your machine.

Now , we are www-data and i cd(change directory) to /home/charlie

and i found a file called “teleport” and it is a private ssh key.

Now, we will use this ssh key to login to the target machine as charlie.

command= ssh -i id_rsa(ssh key) charlie@IP

Now we can cat out the user.txt flag

Now all we have to do now is to find the charlie’s password and the root flag.

As usual, i checked the sudo permissions .

command= sudo -l

We can see that charlie can run vi (it’s vim) as sudo.

But we have to find the charlie’s password first . For that i went back to the /var/www/html directory and started seeing the contents of all files and i found

Now , we know the charlie’s password and for privilege escalation i went to GTFObins and found a sudo command for vim (just type vi instead of vim ).

Now , we see a root.py

Let’s run this file : command=python root.py and it was asking for a key and we found a key in the beginning ( when we found command execution on the web page (key_rev_key)).

Now, we have answered all the questions and found all the flags for this machine .

Thankyou for reading my writeup and have a nice day.