Contrabando — THM Writeup | The Hack Sparrow

Executive summary — Contrabando is a Hard Linux machine solved by chaining flaws: an Apache server with a double-URL-encoding LFI, an HTTP Request Smuggling bug (CVE-2023-25690) that yields execution as www-data inside a container, a pivot to a host-side Flask app with SSTI for a shell as hansolo, and a two-stage escalation via a vault script that compares passwords with globs and a python2 binary runnable as root. A Web → Container → Host → Root path.

Platform	TryHackMe
Operating system	Linux
Difficulty	Hard
Room	Contrabando
Target IP	`10.10.136.151`

Attack map

[80/HTTP]  Apache 2.4.55 (container)
   │  custom scanner → /page/index.php (LFI), /page/gen.php (cmd inj)
   │  LFI via double URL-encoding  (..%252f)
   ▼
[SMUGGLING]  CVE-2023-25690  →  internal POST /gen.php
   │  reverse shell as www-data inside the container
   ▼
[FLASK :5000]  host-side SSTI  (website_url → remote template)
   │  {{ ... __import__("os").popen(...) }}  →  shell as hansolo
   ▼
[VAULT]  sudo /usr/bin/vault  →  glob-based comparison
   │  brute-force character by character  →  hansolo's password
   ▼
[ROOT]  sudo /usr/bin/python2 /opt/generator/app.py  →  __import__("os").system("bash")

1. Target configuration

Before starting, add the IP and hostname to /etc/hosts so requests to contrabando.thm resolve correctly:

echo "10.10.136.151 contrabando.thm" | sudo tee -a /etc/hosts

Resumen ejecutivo — Contrabando es una máquina Linux de dificultad Hard que se resuelve encadenando fallos: un servidor Apache con LFI por doble codificación de URL, un HTTP Request Smuggling (CVE-2023-25690) que da ejecución como www-data dentro de un contenedor, un pivote hacia una app Flask con SSTI en el host que da shell como hansolo, y una doble escalada por un script vault con comparación de globs y un binario python2 ejecutable como root. Recorrido Web → Contenedor → Host → Root.

Plataforma	TryHackMe
Sistema operativo	Linux
Dificultad	Hard
Room	Contrabando
IP objetivo	`10.10.136.151`

Mapa del ataque

[80/HTTP]  Apache 2.4.55 (contenedor)
   │  scanner propio → /page/index.php (LFI), /page/gen.php (cmd inj)
   │  LFI por doble URL-encoding  (..%252f)
   ▼
[SMUGGLING]  CVE-2023-25690  →  POST /gen.php interno
   │  reverse shell como www-data dentro del contenedor
   ▼
[FLASK :5000]  SSTI en el host  (website_url → plantilla remota)
   │  {{ ... __import__("os").popen(...) }}  →  shell como hansolo
   ▼
[VAULT]  sudo /usr/bin/vault  →  comparación con globs
   │  fuerza bruta carácter a carácter  →  contraseña de hansolo
   ▼
[ROOT]  sudo /usr/bin/python2 /opt/generator/app.py  →  __import__("os").system("bash")

1. Configuración del objetivo

Antes de empezar, añadimos la IP y el hostname al fichero /etc/hosts para que las peticiones a contrabando.thm resuelvan correctamente:

echo "10.10.136.151 contrabando.thm" | sudo tee -a /etc/hosts

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.