Agent T Writeup
Agent-T
Agent T is popular TryHackMe Machine which runs on a old version of PHP and you can exploit it with just simple steps
TryhackMe Machines runs on vulnerable system.It allows us to find the structure of a machine like what type of technology it is using and how can we exploit it.
We just have to join the room and then start the Machine:
Once You Start click “Start Machine” then you have to wait for 60 seconds and then you will have your Machine’s IP
Now you have to configure you VPN which you can get from Manage Account < VM and VPN Setting and then download the Configuration file.
Now we have to configure the VPN Properly:
After Downloading the VPM Configuration file run this command
1
sudo openvpn example.ovpn
Now we can work on it
The First step is to enumerate the services and technologies our vulnerable machine is using.
For this I will use Nmap.A powerful tool for network scanning
I will use -A flag for Agressive Scan
1
sudo nmap -A IP
I got the results.this machine is running only on port 80.
Port 80 is used for http and the machine is using this partucular technology “PHP” version ‘PHP 8.1.0-dev’
http://IP And this Result occurs
Lets check for this particular exploit online
Now we have confirmed that this version is vulnerable so we will use Exploit-DB for this attack
If you have not instelled the Exploit-db in the kali so Run
1
sudo apt install exploitdb
For Updating database
1
searchsploit -u
To Use this
Usage
| **Searchploit | Version name** |
Run
1
`searchploit PHP 8.1.0-dev`
There are a lot of exploits here
But we will this one:
How to install it
Searchploit -m ‘exploit path’
Run
1
searchploit -m php/webapps/49933.py
It will be installed in your machine
Now we have organize it professionally
Important: When we install any exploit so it stores like 49933.py so we have to rename it so we remember that
1
2
3
4
5
6
7
8
9
mv 49933.py PHP-8.1.0-dev.py
# Then Make a directory
mkdir PHP-8.1.0-dev
# change path of the exploit
cp PHP-8.1.0-dev.py PHP-8.1.0-dev
Now our exploit is in the PHP-8.1.0-dev directory
Lets Interact with it
1
python3 PHP-8.1.0-dev.py
It is asking for full host url
copy the host from your browser and then paste here
http://IP then press enter
Now we have gained the access
lets search for the flag
As you know I used the ls command but it didn’t show me anything
So we will use this:
../../../../../../../
Lets understand what it is ??
After using ls command we didn’t get anything because this is actually a classic vulnerability called Directory Traversal (Path Traversal) You probably got no useful output because the web application was only allowing you to see files inside a restricted directory.Example:
/var/www/html/files/
So the application might internally run something like:
ls /var/www/html/files/
Meaning you can only see files inside files/.
When you use:
../
so you will You go up one directory:
/var/www/html/
if you repeat:
../../
You go up two levels:
/var/www/
If you keep repeating it:
../../../../../../
Eventually you reach the root directory /
When you used:
../../../../../../..
You escaped the restricted folder.
Instead of:
/var/www/html/files/
the server interpreted something like:
/var/www/html/files/../../../../../../
Linux resolves it to:
/
So now the command effectively became:
ls /
Which lists the entire root filesystem.
Example output:
1
2
3
4
5
6
7
8
9
10
11
12
bin
boot
dev
etc
flag.txt
home
lib
opt
root
tmp
usr
var
So you bypassed the directory restriction.
Now see you can see the flag.txt
To view the flag.txt file
cat ../../../../../../../flag.txt
and you will get the flag:
flag{##################}
Why the Website Allowed This
The vulnerability exists because the application did not sanitize user input.
Secure code should block ../
Example secure filter:
1
2
if "../" in user_input:
reject()
But the vulnerable application allowed it, so you could escape the intended directory