Tryhackme: Plotted-TMS walkthrough

Vineeth Bharadwaj P
5 min readMar 5, 2022

This is a simple box with a straight forward SQLi vulnerability, which can be exploited to upload a php-reverse shell, and then use the cronjob script which is running every minute to escalate privileges.
The box also has some rabbit holes, but nothing that will waste too much of your time.

Link to box: Plotted-TMS


Let’s start with a quick nmap scan.
I start with the following options, to get some quick idea as to what we are exploring. For this easy box, this is more than sufficient.

nmap -sV -sC -T4 -vv -Pn -oN nmap_quick
nmap result

I see that there are 3 ports open, with a ssh port on 22, and the other two running a http server.

I next enumerated the http servers. I used ffuf to enumerate for the directories. Opening both the sites on the browser takes us to the default Apache server welcome page, which is not that interesting.

Port 80 http server enumeration

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u

All of the above findings are rabbit holes, and will not lead us anywhere.

/admin gives us an ‘id_rsa’ file, but it has a base64 encoded string which is of no use.. as I said, a rabbit hole.

The same with the /passwd and /shadow. Let’s not waste time with more useless screenshots.

Port 445 http server enumeration

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u

port 445 has some findings which will interest us.

Let’s start by visiting the obvious one, /management

I searched for “Traffic Offense Management System” on exploitdb, and found that it’s vulnerable to SQL injection attack.

Following is the exploit link if you want to have a look:

Further, I opened burp, and visited the site and tried to login with random credentials. I could see the SQL command in response, which confirmed that the site is vulnerable to SQLi.

sql syntax highlighted in the response

Now to do some basic SQL attack. I use admin’ OR ‘1’=’1 as the username, some random password, and it automatically logs into the admin panel.

By running ffuf again on /management, I found the /management/uploads directory. I uploaded a php-reverse-shell script to get a reverse shell.

Link to script:

Exploit — Getting Reverse shell

I configured the php script to call back my attack machine. Uploading it is a piece of cake.

uploading reverse shell script

The TMS portal has no filters for the files uploaded. I selected the configured script from the computer, and uploaded it.

Next, the usual, starting a netcat listener, and opening the script.

I visit, which opens the script, and got the reverse shell on the netcat listener.

netcat reverse shell

Next I stabilize the shell, and look for the flags. We cannot yet read the user flag. We don’t have the permissions yet.

Privilege Escalation

I see that there is a cronjob running as the plot_admin user. We will use this to escalate our privilege to plot_admin user.

cat /etc/crontab

We have permission to write to the /var/www/scripts/ directory.

I use this to upload my own script which gives me the reverse shell as the plot_admin user.

I use the below script in the screenshot, and upload it by spawning a simple python http server.

Make sure to remove the existing ‘’ file, and download the file described above. Remember to make it an executable.

Now open another netcat listener with the port specified in the above file. In my case, it was 2222.

I waited for a minute, and got the reverse shell as plot_admin user.

reverse shell with elevated privilege as plot_admin user

With this, we are good to read the user.txt file.


Now for the root flag.

When searching for interesting binaries, I came across ‘doas’. This is a little unusual for a Linux system. doas tool is the OpenBSD implementation of the well known sudo tool.

I check the doas configuration, and find that openssl can be run with root privilege.

Next, I went to and found we can use openssl to read the files.

reading root.txt

With that we have the root flag.



Vineeth Bharadwaj P

Automotive/I.T Security. Artist. Photographer. Germany/India