search
GitHub PortfolioTwitter/XMediumCont@ct

Simple CTF

tryhackme.com - © TryHackMe

🔗 Simple CTFarrow-up-right

hashtag
Task 1 - Deploy the machine

🎯 Target IP: 10.10.86.206

Create a directory for machine on the Desktop and a directory containing the scans with nmap.

hashtag
Task 2 - Reconnaissance

I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.

Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.

hashtag
2.1 - How many services are running under port 1000?

2 ports open under port 1000

hashtag
2.2 - What is running on the higher port?

The higher port is 2222

SSH is running on port 2222

hashtag
2.3 - What's the CVE you're using against the application?

OpenSSH 7.2p2 is a pretty old version. We can search exploits on Exploid-DB website or with:

hashtag
2.4 - To what kind of vulnerability is the application vulnerable?

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9053arrow-up-right

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

This means that we need to look for a login form

SQLi

hashtag
2.5 - What's the password?

Now, try to inspect webpage and his resource. I start by searching for info on the site with whatweb.

Then I search from browser for the site, inspect the code and the file /robots.txt

simple_ctf.thm:80image
html source code
robots.txt

After these standard checks, we look for any hidden pathways with gobuster.

We found this interesting path:

simple_ctf.thm/simple

We perform the search only on this specific route:

We found this interesting path:

simple_ctf.thm/simple/admin

We finally found our login page, return to exploit db and analyze the exploit code.

We save the file, make it executable, and run it.

In Python 3, the print statement has been replaced with the print() function, which must be called with parentheses. In Python 2, the print statement did not require parentheses.

We can convert script to python3 vs:

secret

hashtag
2.6 - Where can you login with the details obtained?

SSH

hashtag
2.7 - What's the user flag?

chevron-right🚩 Flag (user.txt)hashtag

hashtag
2.8 - Is there any other user in the home directory? What's its name?

sunbath

hashtag
2.9 - What can you leverage to spawn a privileged shell?

On to privileged escalation! First I like to start off with running “sudo -l” to see what my current user can run.

We can see the user “mitch” can run /usr/bin/vim without a password. With that information, let’s check out GTFOBins and see if we can use that for privesc.

Vim

2.10 - What's the root flag?

chevron-right🚩 Flag (root.txt)hashtag

W3ll d0n3. You made it!

PreviousTryHackMe - Capture The Flag Writeups (CTF)NextRootMe