This is my first writeup/walkthrough post for the TryHackMe website.
TryHackMe is online platform for learning cyber security, using hands-on exercises and labs.
This post refers to the Task 5 - Practical: Manual Explotaition which is part of the module of Exploit Vulnerabilities on THM JR penetration tester course.
Task 5 is final task in this submodule and is to show practical example of things you learned through the previous tasks.
First step is to start VM that you will try to exploit as description says it requires few minutes to boot up. If you will use Attackbox on their site don't forget to start it also.
Second step To answer the Q1 you need to just open website that is hosted on VM you started in first step. Scroll down to the bottom of the page and voila you will find name version of the website.
Third step Now that you know website version you will need to find the way to exploit and gain access to it. You could also online tools but this Task 5 one aims towards use of the searchsploit tool that is installed and ready to use in Attackbox machine. we use following command:
searchsploit online book store
We get 4 different results, but we choose last from the list wich offers remote code execution.
Forth step - To start exploit you will use following command:
python name_of_script.py VM_IP
Since I was not in the same directory as exploit script I got error that exploit script was not found, so I used:
locate 47887.py
With that I found correct location of the exploit script and then i could ran exploit script correctly without errors:
python path_to_the_exploit_/47887.py VM_ip_Address
You are then only prompted to continue with exploit and in matter of seconds you get access to the shell of the VM.
Fifth step - finding flag.txt file and answer to the Q3 of this task.
This did not require much of the search since file is located in current folder and I used
cat flag.txt
To display flag.txt file content.
I hope that this post is helpful for anyone trying to solve this challenge.
audittrsi
