> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/jpgchat.md).

# JPGChat

![](/files/-McppnTLGNhtlsTnJx6u)

## Scanning

Lets run some nmap scan to get information about the open ports and services on the machine

![](/files/-McpqFrx7nXgtjOPPSTY)

## Enumeration

Lets visit port 3000

![](/files/-McpqlQYraWntZ8WhmsJ)

There is nothing of interest in the source code and nothing in the Developer tools, so lets go find the admins GitHub they talk about.

![](/files/-Mcprp0AyFBs7ZXlrOPn)

We have a file, lets copy it to our machine and check the code out.

![](/files/-Mcps4C3BxVYZuUi6GpO)

Looking at the code, we can see that the os.system is used to echo the input from \[REPORT] to a text file. There is no sanitization of input, we can exploit this by using `';` to close the echo command and then we can run any command followed by a `#`

## Exploitation

Lets connect to the web app on port 3000 using netcat so that we can interact with the chat service.

Lets first start a netcat listener and then execute the commands to get a reverse shell

![](/files/-McpuSbPxdzn96daYnMq)

Now lets run the commands by choosing the `REPORT` option

![](/files/-McpuZH-7i-HlL6ROjP6)

After running these commands, you should get a reverse shell

![](/files/-McpumLMuMLOn8fkcOdh)

Lets stabilize the shell.

![](/files/-Mcpuy_KLwlZITmyQeYq)

Lets read the user flag

![](/files/-McpvK65nx2yHFBiLrkZ)

## Privilege Escalation

Lets run `sudo -l` to see what we can run as other users.

![](/files/-McpvaBdW5TA6K8YLEQ0)

Looks like we can run this file, lets check what it contains and also the permissions of the file.

![](/files/-McpwBOrWE1UZMNPA69X)

Looks like we are importing the compare module. So what we can do is change the `Environment variable` and set it to our own `compare.py` file with a root shell spawn and then run the file which will run our file and give us a root shell.

Lets first create our compare.py file and add the script that will give us a root shell.

![](/files/-McpyMM8uzGtYerMyqO0)

Lets now force python to load our module file instead of any other and run the `test_module.py` file

![](/files/-McpyXi7CW5uYfhh2xBq)

We are now root. We can read the root flag

![](/files/-Mcpyo1WtNlwgoC1CkHV)