# THM WriteUP | Epoch

# **Intro**

Hello ethical hackers! Today we are going to pass the [**Epoch**](https://tryhackme.com/room/epoch) on [**TryHackMe**](https://tryhackme.com/). This lab has tags: CLI, Epoch.

# Recon

## Scanning

For no need to enter IP again and again. I exported IP like a variable in current bash shell.

```bash
export IP=*.*.*.*
```

Then i scan the host with [**rustscan**](https://github.com/RustScan/RustScan).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676624820213/a5c4951a-9340-4c5d-997b-53782bc98841.png align="center")

## Web recon

Okey, found ssh and http server. Let's analyze web:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676625069811/dd03d971-4325-4c71-80fd-342778151af5.png align="center")

Hm... We see time converter. In source code nothing intersting.

Try to test it:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676629966236/883c8bcd-b808-4aac-9c98-df94d18bdd36.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676629979144/a51940e7-1e39-4877-9b90-3a944cba9595.png align="center")

I tried XSS, SQLi, but nothing works... I back to machine description and reread it.

<mark>Wait... it doesn't need to be online, you say? Are you telling me there is a command-line Linux program that can already do the same thing.</mark>

# Command Injection

That sounds like a hint. Try to command injection this form.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676626520075/08cdc3af-e9c0-4dfe-8584-bbf20f659620.png align="center")

Nice, it works! May be try spawn reverse shell?

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676626607314/78901f91-6110-492f-bfd8-74c1115d0098.png align="center")

Yep! We have access to the machine. But we don't see flag in home directory...

# Flag

Check `env` and yeah, we found flag!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1676629918754/a6786773-edc9-4563-8d68-2b9361d2ed80.png align="center")