Simple CTF
Task 1 - Deploy the machine
🎯 Target IP: 10.10.86.206
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system (probably Linux), while Windows systems usually have a TTL of 128 secs.
2.1 - How many services are running under port 1000?
2 ports open under port 1000
2.2 - What is running on the higher port?
The higher port is 2222
SSH is running on port 2222
2.3 - What's the CVE you're using against the application?
OpenSSH 7.2p2 is a pretty old version. We can search exploits on Exploid-DB website or with:
2.4 - To what kind of vulnerability is the application vulnerable?
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9053
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
This means that we need to look for a login form
SQLi
2.5 - What's the password?
Now, try to inspect webpage and his resource. I start by searching for info on the site with whatweb.
Then I search from browser for the site, inspect the code and the file /robots.txt
After these standard checks, we look for any hidden pathways with gobuster.
We found this interesting path:
We perform the search only on this specific route:
We found this interesting path:
We finally found our login page, return to exploit db and analyze the exploit code.
We save the file, make it executable, and run it.
In Python 3, the print statement has been replaced with the print() function, which must be called with parentheses. In Python 2, the print statement did not require parentheses.
We can convert script to python3 vs:
secret
2.6 - Where can you login with the details obtained?
SSH
2.7 - What's the user flag?
2.8 - Is there any other user in the home directory? What's its name?
sunbath
2.9 - What can you leverage to spawn a privileged shell?
On to privileged escalation! First I like to start off with running “sudo -l” to see what my current user can run.
We can see the user “mitch” can run /usr/bin/vim without a password. With that information, let’s check out GTFOBins and see if we can use that for privesc.
Vim
2.10 - What's the root flag?
Last updated