{"id":84,"date":"2021-03-21T21:44:00","date_gmt":"2021-03-21T21:44:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=84"},"modified":"2025-12-13T21:45:23","modified_gmt":"2025-12-13T21:45:23","slug":"vulnversity-tryhackme-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=84","title":{"rendered":"Vulnversity- TryHackMe lab"},"content":{"rendered":"\n<p class=\"has-text-align-center\">Today I am working on the Vulnversity challenge from tryhackme.com<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.08.55-PM.png\" alt=\"\" class=\"wp-image-4728\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">I start with an nmap scan with the service version flag against the host: nmap -sV hostipaddress<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.09.16-PM.png\" alt=\"\" class=\"wp-image-4729\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">TryHackMe had a great nmap reference table so I pasted it below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.09.30-PM-1024x388.png\" alt=\"\" class=\"wp-image-4730\"\/><\/figure>\n\n\n\n<p class=\"has-text-align-center\">I found a web server on port 3333 and started to look into it<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-8.28.03-PM.png\" alt=\"\" class=\"wp-image-4731\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">I then used the tool gobuster to check for pages on the web server<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.24.12-PM-1.png\" alt=\"\" class=\"wp-image-4734\"\/><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.28.42-PM-1024x336.png\" alt=\"\" class=\"wp-image-4733\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">Cheching the internal page, I found an upload form<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.31.49-PM-1024x224.png\" alt=\"\" class=\"wp-image-4735\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">Now I can upload a reverse shell<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.32.35-PM.png\" alt=\"\" class=\"wp-image-4736\"\/><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.50.07-PM-1024x650.png\" alt=\"\" class=\"wp-image-4737\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">The form did not allow .php file types, I used Burp Suite to attempt different file types, .phtml worked so I just renamed the file.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.51.32-PM.png\" alt=\"\" class=\"wp-image-4738\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">I started a netcat listener on my attack machine to connect to the reverse shell<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-6.52.26-PM.png\" alt=\"\" class=\"wp-image-4739\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">I uploaded the file and connected to a shell <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2021\/03\/Screen-Shot-2021-03-20-at-7.26.48-PM-1024x320.png\" alt=\"\" class=\"wp-image-4741\"\/><\/figure>\n<\/div>\n\n\n<p class=\"has-text-align-center\">I now have a shell on the webserver, next I need to escalate privileges<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today I am working on the Vulnversity challenge from tryhackme.com I start with an nmap scan with the service version flag against the host: nmap -sV hostipaddress TryHackMe had a great nmap reference table so I pasted it below: I found a web server on port 3333 and started to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-84","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/84","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=84"}],"version-history":[{"count":1,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/84\/revisions"}],"predecessor-version":[{"id":85,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/84\/revisions\/85"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=84"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=84"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=84"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}