Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
su
echo "10.10.86.206 simple_ctf.thm" >> /etc/hosts
mkdir thm/simple_ctf
cd thm/simple_ctf
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
ping -c 3 simple_ctf.thm
PING simple_ctf.thm (10.10.86.206) 56(84) bytes of data.
64 bytes from simple_ctf.thm (10.10.86.206): icmp_seq=1 ttl=63 time=72.8 ms
64 bytes from simple_ctf.thm (10.10.86.206): icmp_seq=2 ttl=63 time=80.6 ms
64 bytes from simple_ctf.thm (10.10.86.206): icmp_seq=3 ttl=63 time=61.8 ms
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - How many services are running under port 1000?
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-04 12:36 CEST
Nmap scan report for simple_ctf.thm (10.10.86.206)
Host is up (0.066s latency).
Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
2222/tcp open EtherNetIP-1
2 ports open under port 1000
2.2 - What is running on the higher port?
The higher port is 2222
2222/tcp open EtherNetIP-1
nmap -p2222 -sC -sV simple_ctf.thm
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-04 12:43 CEST
Nmap scan report for simple_ctf.thm (10.10.86.206)
Host is up (0.062s latency).
PORT STATE SERVICE VERSION
2222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 294269149ecad917988c27723acda923 (RSA)
| 256 9bd165075108006198de95ed3ae3811c (ECDSA)
|_ 256 12651b61cf4de575fef4e8d46e102af6 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
SSH is running on port 2222
2.3 - What's the CVE you're using against the application?
OpenSSH 7.2p2 is a pretty old version. We can search exploits on Exploid-DB website or with:
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
This means that we need to look for a login form
SQLi
2.5 - What's the password?
Now, try to inspect webpage and his resource. I start by searching for info on the site with whatweb.
File "/home/kali/thm/simple_ctf/exploit.py", line 25
print "[+] Specify an url target"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?
In Python 3, the print statement has been replaced with the print() function, which must be called with parentheses. In Python 2, the print statement did not require parentheses.
2.6 - Where can you login with the details obtained?
ssh mitch@simple_ctf.thm -p 2222
The authenticity of host '[simple_ctf.thm]:2222 ([10.10.86.206]:2222)' can't be established.
ED25519 key fingerprint is SHA256:iq4f0XcnA5nnPNAufEqOpvTbO8dOJPcHGgmeABEdQ5g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[simple_ctf.thm]:2222' (ED25519) to the list of known hosts.
mitch@simple_ctf.thm's password:
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.15.0-58-generic i686)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
0 packages can be updated.
0 updates are security updates.
Last login: Mon Aug 19 18:13:41 2019 from 192.168.0.190
SSH
2.7 - What's the user flag?
$ $ ls
user.txt
$ cat user.txt
🚩 Flag (user.txt)
G00d j0b, keep up!
2.8 - Is there any other user in the home directory? What's its name?
$ cd ..
$ ls
mitch sunbath
sunbath
2.9 - What can you leverage to spawn a privileged shell?
On to privileged escalation! First I like to start off with running “sudo -l” to see what my current user can run.
sudo -l
User mitch may run the following commands on Machine:
(root) NOPASSWD: /usr/bin/vim
We can see the user “mitch” can run /usr/bin/vim without a password. With that information, let’s check out GTFOBins and see if we can use that for privesc.
