LazyAdmin - TryHackMe Walkthrough

Goal: Gain a foothold on a web server running an outdated CMS, escalate to root, and retrieve both flags (user.txt and root.txt). Target: 10.64.144.100 (re-deployed mid-box as 10.64.161.87, both appear in the screenshots below)

---

1. Reconnaissance

Kicked things off with a standard nmap scan:

nmap 10.64.144.100 -sV -p-

Two ports open. 22 (SSH) and 80 (HTTP/Apache2). Nothing else exposed, so the web server is the obvious way in.

While the scan ran, I checked the site in the browser: default Apache2 Ubuntu landing page. robots.txt and sitemap.xml both came back empty, and viewing the raw HTML turned up nothing hidden in comments.

With nothing on the root page, moved to directory brute-forcing:

gobuster dir -u http://10.64.144.100 -x .php,.html -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

One entry stands out: /content.

---

2. Enumerating the CMS

/content serves a half-finished site sitting on an install/setup page.

The page links out to http://www.basic-cms.org/docs/5-things-need-to-be-done-when-SweetRice-installed/, which no longer resolves to the real docs, it 302s off to https://go-get-some.net/go/2429217..........

Rabbit hole. I looked into this for a few minutes wasting my time. The basic-cms.org domain expired years ago and is now parked on an ad/redirect network. Ignore it and keep enumerating.

Ran a second, targeted gobuster against /content to map the app properly (IP differs from here on due to a machine restart on TryHackMe):

gobuster dir -u http://10.64.161.87/content -w /usr/share/wordlists/dirb/common.txt -x .php,.txt,.html

Digging through those directories confirms the version - changelog.txt reveals SweetRice 1.5.1.

searchsploit sweetrice returns several hits for this version. Three are relevant:

Exploit	EDB-ID	Use
SweetRice 1.5.1: Backup Disclosure	40718	Unauthenticated read of MySQL backups
SweetRice 1.5.1: Cross-Site Request Forgery (Add Admin) / arbitrary PHP via Ads	40700	Authenticated RCE
SweetRice 1.5.1: Arbitrary File Upload	40716	Authenticated upload to Media Centre (alternate path)

---

3. Credential Disclosure

The backup disclosure exploit points at an unauthenticated directory:

http://10.64.161.87/content/inc/mysql_backup/

Sure enough, a .sql dump is sitting there.

Downloaded and cat’d the file. Inside the INSERT statements for the SweetRice options table, there’s an admin account: user manager with an MD5 password hash.

The hash is unsalted MD5 and already in every rainbow table on the internet. CrackStation cracks it instantly.

The SweetRice admin panel lives at /content/as. Logged in with the cracked creds:

---

4. Initial Access (www-data)

SweetRice’s Ads feature writes whatever you paste into it straight to a .php file under /content/inc/ads/. That’s arbitrary PHP file creation as an authenticated admin, exactly what EDB-40700 abuses via CSRF, except we already have the session, so we can just do it directly.

Pasted the PentestMonkey PHP reverse shell into a new ad, with $ip and $port set to my Kali box.

Started a listener locally:

nc -lvnp 9001

From here, we can execute it by viewing /content/inc/ads, then clicking the new ad you created. Alternatively, go straight to the file:

http://10.64.161.87/content/inc/ads/revshell.php

Shell as www-data.

Upgraded to a proper TTY, which matters for the privesc step later. The root shell I end up spawning is interactive, and it won’t behave without a real terminal:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

Note to self: user.txt was sitting in /home/itguy/ and readable by www-data the whole time, I could have grabbed it right here. I skipped straight to privesc and only collected it at the end alongside the root flag. Listing home directories should be the first thing I do after landing a shell.

---

5. Privilege Escalation

Started with the usual checks, both of which were dead ends:

find / -type f -perm -4000 2>/dev/null    # nothing unusual
cat /etc/crontab                          # nothing

Then remembered to run the one thing I should have run first:

sudo -l

User www-data may run the following commands on THM-Chal:
    (ALL) NOPASSWD: /usr/bin/perl /home/itguy/backup.pl

Looking further at the script:

cat /home/itguy/backup.pl

It does one thing, shells out to /etc/copy.sh. And /etc/copy.sh already contains a hardcoded netcat reverse shell haha.

The key detail: /etc/copy.sh is world-writable, and backup.pl runs it as root. So whatever I put in copy.sh executes as root.

Overwrote it with an interactive bash and triggered it through the sudo entry:

echo "/bin/bash -i" > /etc/copy.sh
sudo /usr/bin/perl /home/itguy/backup.pl

id confirms uid=0(root).

As root, I grabbed both flags - /home/itguy/user.txt and /root/root.txt.

---

Summary

Step	Action	Finding / Result
1. Recon	nmap -sV -p-	Ports 22 (SSH), 80 (Apache2) open
2. Web enum	gobuster dir	/content → SweetRice CMS
3. Version ID	changelog.txt	SweetRice 1.5.1
4. Exploit research	searchsploit sweetrice	Backup disclosure (40718), Ads RCE (40700)
5. Cred disclosure	/content/inc/mysql_backup/	manager + MD5 hash
6. Cracking	CrackStation / hashcat -m 0	Plaintext admin password
7. Auth	/content/as	Admin access to SweetRice
8. RCE	Ads → PHP reverse shell → /content/inc/ads/revshell.php	Shell as www-data
9. Privesc enum	sudo -l	(ALL) NOPASSWD: /usr/bin/perl /home/itguy/backup.pl
10. Privesc	Overwrote world-writable /etc/copy.sh, ran backup.pl via sudo	Root shell
11. Flags	/home/itguy/user.txt, /root/root.txt	Both collected as root

---

Key Takeaways

• Run sudo -l first, not last. I burned time on SUID sweeps and crontab before checking the single cheapest privesc enumeration command there is. Build the habit: id, sudo -l, then everything else.
• Check the box before you escalate. user.txt was readable as www-data from the moment I landed, but I tunnel-visioned on root and picked it up at the very end. A quick ls -la /home/* won’t hurt.
• Version disclosure drives everything. The homepage didn’t show a version, but changelog.txt did. Once you have SweetRice 1.5.1, searchsploit does the rest, the whole chain fell out of one string.
• Legitimate features are attack surface. The Ads panel is designed to write PHP files. No memory corruption, no clever bypass, just an admin feature that should never have shipped with unrestricted code execution.
• Upgrade your shell early. Spawning /bin/bash -i as root is useless from a raw netcat session. The TTY upgrade takes ten seconds and prevents a frustrating dead end at the finish line.
• Not every anomaly is part of the box. The go-get-some.net redirect and the junk JS looked suspicious but were just an expired domain being parked. Recognizing dead ends quickly is important.