Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
suecho"10.10.86.206 simple_ctf.thm">>/etc/hostsmkdirthm/simple_ctfcdthm/simple_ctf# At the end of the room# To clean up the last line from the /etc/hosts filesed-i'$ d'/etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - How many services are running under port 1000?
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
This means that we need to look for a login form
SQLi
2.5 - What's the password?
Now, try to inspect webpage and his resource. I start by searching for info on the site with whatweb.
File"/home/kali/thm/simple_ctf/exploit.py",line25print"[+] Specify an url target"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^SyntaxError:Missingparenthesesincallto'print'.Didyoumeanprint(...)?
In Python 3, the print statement has been replaced with the print() function, which must be called with parentheses. In Python 2, the print statement did not require parentheses.
2.6 - Where can you login with the details obtained?
sshmitch@simple_ctf.thm-p2222
Theauthenticityofhost'[simple_ctf.thm]:2222 ([10.10.86.206]:2222)'can't be established.ED25519 key fingerprint is SHA256:iq4f0XcnA5nnPNAufEqOpvTbO8dOJPcHGgmeABEdQ5g.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '[simple_ctf.thm]:2222' (ED25519) to the list of known hosts.mitch@simple_ctf.thm'spassword:WelcometoUbuntu16.04.6LTS (GNU/Linux 4.15.0-58-generici686)*Documentation:https://help.ubuntu.com*Management:https://landscape.canonical.com*Support:https://ubuntu.com/advantage0packagescanbeupdated.0updatesaresecurityupdates.Lastlogin:MonAug1918:13:412019from192.168.0.190
SSH
2.7 - What's the user flag?
$ $ lsuser.txt$catuser.txt
🚩 Flag (user.txt)
G00d j0b, keep up!
2.8 - Is there any other user in the home directory? What's its name?
$cd..$lsmitchsunbath
sunbath
2.9 - What can you leverage to spawn a privileged shell?
On to privileged escalation! First I like to start off with running “sudo -l” to see what my current user can run.
We can see the user “mitch” can run /usr/bin/vim without a password. With that information, let’s check out GTFOBins and see if we can use that for privesc.
