Inclusion — TryHackMe — Writeup

Hello. I’m Rahmos. Here is my Inclusion — TryHackMe — Writeup. Check it out!

First deploy the machine and use nmap to scan for opened ports.

nmap

Now let’s access its website as a web server is present.

website

Let’s click an article

article

Now I have the syntax for the web. Let’s replace “name=hacking” to “name=../../../../../etc/passwd”

LFI /etc/passwd

Success! Now i have the content of /etc/passwd file. Look at the second last line, you see will see a credential of falconfeast password

Let’s ssh using this credential

ssh falconfeast@<ip>

ssh

Now we’re in.

user.txt

Get the user.txt flag.

Now try to get root. First sudo -l so see which cmd we can run as root.

sudo -l

Well we can run socat as root without password needed.

As reference to https://gtfobins.github.io/gtfobins/socat/#sudo , execute this cmd to get root:

sudo socat stdin exec:/bin/sh

socat

Ok now i’m root! cd to /root and get our final flag.

root.txt

The end.

HAPPY HACKING