Understanding CTF TryHackMe - Include

This practical walkthrough demonstrates a structured Capture The Flag (CTF) challenge that simulates real-world penetration testing scenarios. You'll learn how to identify and exploit vulnerabilities across web applications, APIs, and server configurations through a methodical approach—from initial reconnaissance to privilege escalation and flag retrieval.

Key Learning Objectives

Reconnaissance: Identify attack surfaces using port scanning and service enumeration
Web Application Testing: Exploit vulnerabilities in Node.js and Apache applications
Privilege Escalation: Manipulate request parameters to gain unauthorized access
API Security: Leverage internal APIs to extract sensitive credentials
Local File Inclusion (LFI): Bypass filters to access restricted system files
Brute Force Techniques: Crack authentication using password lists
User Enumeration: Extract valid usernames for targeted attacks

Initial Reconnaissance

Port Scanning with Nmap

Begin by mapping the target's attack surface to identify open services and potential entry points.

Command:

nmap -sV <TARGET_IP>

Discovered Services:

Port	Service	Version	Notes
22	SSH	OpenSSH 8.2p1	Potential brute force target
25	SMTP	Postfix	Mail service
110/995	POP3 / SSL POP3	Dovecot	Email retrieval
143/993	IMAP / SSL IMAP	Dovecot	Email access
4000	HTTP	Node.js (Express)	Primary target
50000	HTTP	Apache 2.4.41	Secondary target

Critical Finding: Two web applications on ports 4000 and 50000 present the main attack vectors for this challenge.

Web Application Analysis

Port 4000: Review Application (Node.js)

Initial Access:

Login page accepts default credentials: guest:guest
Features include social networking functionality (friend requests, profile editing)

Vulnerability Discovery:

Profile update requests contain an isAdmin parameter
This parameter is client-side controlled and not properly validated server-side

Port 50000: SysMon Dashboard (Apache)

Initial State:

Protected admin panel requiring credentials
Access credentials must be obtained through exploitation of the Review App

Privilege Escalation Attack

Exploiting the isAdmin Parameter

Intercept and modify the profile update request to escalate privileges from guest to administrator.

Attack Vector:

Log in as guest:guest on port 4000
Navigate to profile settings
Intercept the profile update request (using Burp Suite or browser DevTools)
Modify the JSON payload:

{
  "username": "guest",
  "isAdmin": true
}

Result:

Unlocks hidden Settings and API sections
Demonstrates Insecure Direct Object Reference (IDOR) vulnerability

API Exploitation

Discovering Internal Endpoints

After privilege escalation, the API section reveals internal routes:

Example endpoint (non-sensitive)
Sensitive endpoint: /getAllAdmins101099991

Server-Side Request Forgery (SSRF) Attack

Exploitation Steps:

Navigate to the Settings section
Locate the banner image URL field
Replace the image URL with the internal API endpoint:
```
http://127.0.0.1:5000/getAllAdmins101099991
```
Submit the request

Response Handling:

The application fetches the internal API and returns a base64-encoded response
Decode the payload to reveal admin credentials

Decoding Command:

echo "<BASE64_PAYLOAD>" | base64 --decode

Extracted Data:

Admin username and password for both applications
Demonstrates lack of internal network segmentation

Accessing the SysMon Dashboard

Admin Panel Access

Navigate to http://<TARGET_IP>:50000
Log in using the decoded admin credentials
Flag 1 is displayed on the dashboard

Security Lesson: Internal APIs should never be accessible through user-controlled input fields without proper authentication and authorization checks.

Local File Inclusion (LFI) Exploitation

Identifying the Vulnerability

Analyze the SysMon application source code to find dynamic file loading:

/profile?img=<FILE_PATH>

Bypassing Path Traversal Filters

Standard ../ sequences are often filtered. Use encoding and repetition to bypass:

Payload:

....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc%2Fpasswd

Breakdown:

.... bypasses filters that remove ..
%2F is URL-encoded /
Multiple levels traverse to root directory

User Enumeration

Extracted Users from /etc/passwd:

joshua - Regular user account
charles - Additional user account

These usernames become targets for SSH brute force attacks.

SSH Brute Force Attack

Using Hydra for Password Cracking

Target the joshua account with a common password wordlist.

Command:

hydra -l joshua -P /usr/share/wordlists/fasttrack.txt <TARGET_IP> ssh

Parameters:

-l joshua: Specify username
-P: Path to password wordlist
ssh: Target protocol

Successful Authentication:

ssh joshua@<TARGET_IP>

Flag Retrieval

Flag 2 Location:

cat /var/www/html/flag.txt

Attack Chain Summary

Phase	Technique	Outcome
1. Reconnaissance	Nmap port scanning	Identified web apps on ports 4000 and 50000
2. Initial Access	Default credentials	Logged in as `guest` user
3. Privilege Escalation	Parameter tampering (`isAdmin`)	Unlocked admin sections
4. API Exploitation	SSRF via image URL field	Retrieved base64-encoded admin credentials
5. Credential Decoding	Base64 decoding	Obtained SysMon admin access
6. Flag 1	Admin dashboard access	Retrieved first flag
7. LFI Exploitation	Path traversal bypass	Accessed `/etc/passwd`
8. User Enumeration	System file analysis	Identified `joshua` and `charles`
9. Brute Force	Hydra SSH attack	Cracked `joshua`'s password
10. Flag 2	SSH access	Retrieved second flag from `/var/www/html`

Essential Tools Reference

Reconnaissance and Scanning

nmap: Network mapping and service detection
```
nmap -sV -sC -p- <TARGET_IP>
```

Web Application Testing

Burp Suite: HTTP request interception and modification
Browser DevTools: Client-side parameter analysis

Brute Force Attacks

hydra: Multi-protocol password cracking

hydra -l <username> -P <wordlist> <target> <protocol>

Encoding and Decoding

base64: Decode API responses
```
base64 --decode <file>
```

Recommended Wordlists

/usr/share/wordlists/fasttrack.txt: Common passwords
/usr/share/wordlists/rockyou.txt: Comprehensive password list
/usr/share/wordlists/SecLists/Discovery/Web-Content/LFI-Jhaddix.txt: LFI payloads

Security Mitigations

For Defenders

Input Validation:

Sanitize

Key Learning Objectives

Reconnaissance: Identify attack surfaces using port scanning and service enumeration
Web Application Testing: Exploit vulnerabilities in Node.js and Apache applications
Privilege Escalation: Manipulate request parameters to gain unauthorized access
API Security: Leverage internal APIs to extract sensitive credentials
Local File Inclusion (LFI): Bypass filters to access restricted system files
Brute Force Techniques: Crack authentication using password lists
User Enumeration: Extract valid usernames for targeted attacks

Initial Reconnaissance

Port Scanning with Nmap

Begin by mapping the target's attack surface to identify open services and potential entry points.

Command:

nmap -sV <TARGET_IP>

Discovered Services:

Port	Service	Version	Notes
22	SSH	OpenSSH 8.2p1	Potential brute force target
25	SMTP	Postfix	Mail service
110/995	POP3 / SSL POP3	Dovecot	Email retrieval
143/993	IMAP / SSL IMAP	Dovecot	Email access
4000	HTTP	Node.js (Express)	Primary target
50000	HTTP	Apache 2.4.41	Secondary target

Critical Finding: Two web applications on ports 4000 and 50000 present the main attack vectors for this challenge.

Web Application Analysis

Port 4000: Review Application (Node.js)

Initial Access:

Login page accepts default credentials: guest:guest
Features include social networking functionality (friend requests, profile editing)

Vulnerability Discovery:

Profile update requests contain an isAdmin parameter
This parameter is client-side controlled and not properly validated server-side

Port 50000: SysMon Dashboard (Apache)

Initial State:

Protected admin panel requiring credentials
Access credentials must be obtained through exploitation of the Review App

Privilege Escalation Attack

Exploiting the isAdmin Parameter

Intercept and modify the profile update request to escalate privileges from guest to administrator.

Attack Vector:

Log in as guest:guest on port 4000
Navigate to profile settings
Intercept the profile update request (using Burp Suite or browser DevTools)
Modify the JSON payload:

{
  "username": "guest",
  "isAdmin": true
}

Result:

Unlocks hidden Settings and API sections
Demonstrates Insecure Direct Object Reference (IDOR) vulnerability

API Exploitation

Discovering Internal Endpoints

After privilege escalation, the API section reveals internal routes:

Example endpoint (non-sensitive)
Sensitive endpoint: /getAllAdmins101099991

Server-Side Request Forgery (SSRF) Attack

Exploitation Steps:

Navigate to the Settings section
Locate the banner image URL field
Replace the image URL with the internal API endpoint:
```
http://127.0.0.1:5000/getAllAdmins101099991
```
Submit the request

Response Handling:

The application fetches the internal API and returns a base64-encoded response
Decode the payload to reveal admin credentials

Decoding Command:

echo "<BASE64_PAYLOAD>" | base64 --decode

Extracted Data:

Admin username and password for both applications
Demonstrates lack of internal network segmentation

Accessing the SysMon Dashboard

Admin Panel Access

Navigate to http://<TARGET_IP>:50000
Log in using the decoded admin credentials
Flag 1 is displayed on the dashboard

Security Lesson: Internal APIs should never be accessible through user-controlled input fields without proper authentication and authorization checks.

Local File Inclusion (LFI) Exploitation

Identifying the Vulnerability

Analyze the SysMon application source code to find dynamic file loading:

/profile?img=<FILE_PATH>

Bypassing Path Traversal Filters

Standard ../ sequences are often filtered. Use encoding and repetition to bypass:

Payload:

....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc%2Fpasswd

Breakdown:

.... bypasses filters that remove ..
%2F is URL-encoded /
Multiple levels traverse to root directory

User Enumeration

Extracted Users from /etc/passwd:

joshua - Regular user account
charles - Additional user account

These usernames become targets for SSH brute force attacks.

SSH Brute Force Attack

Using Hydra for Password Cracking

Target the joshua account with a common password wordlist.

Command:

hydra -l joshua -P /usr/share/wordlists/fasttrack.txt <TARGET_IP> ssh

Parameters:

-l joshua: Specify username
-P: Path to password wordlist
ssh: Target protocol

Successful Authentication:

ssh joshua@<TARGET_IP>

Flag Retrieval

Flag 2 Location:

cat /var/www/html/flag.txt

Attack Chain Summary

Phase	Technique	Outcome
1. Reconnaissance	Nmap port scanning	Identified web apps on ports 4000 and 50000
2. Initial Access	Default credentials	Logged in as `guest` user
3. Privilege Escalation	Parameter tampering (`isAdmin`)	Unlocked admin sections
4. API Exploitation	SSRF via image URL field	Retrieved base64-encoded admin credentials
5. Credential Decoding	Base64 decoding	Obtained SysMon admin access
6. Flag 1	Admin dashboard access	Retrieved first flag
7. LFI Exploitation	Path traversal bypass	Accessed `/etc/passwd`
8. User Enumeration	System file analysis	Identified `joshua` and `charles`
9. Brute Force	Hydra SSH attack	Cracked `joshua`'s password
10. Flag 2	SSH access	Retrieved second flag from `/var/www/html`

Essential Tools Reference

Reconnaissance and Scanning

nmap: Network mapping and service detection
```
nmap -sV -sC -p- <TARGET_IP>
```

Web Application Testing

Burp Suite: HTTP request interception and modification
Browser DevTools: Client-side parameter analysis

Brute Force Attacks

hydra: Multi-protocol password cracking

hydra -l <username> -P <wordlist> <target> <protocol>

Encoding and Decoding

base64: Decode API responses
```
base64 --decode <file>
```

Recommended Wordlists

/usr/share/wordlists/fasttrack.txt: Common passwords
/usr/share/wordlists/rockyou.txt: Comprehensive password list
/usr/share/wordlists/SecLists/Discovery/Web-Content/LFI-Jhaddix.txt: LFI payloads

Security Mitigations

For Defenders

Input Validation:

Sanitize