Swsctfjournal6

Topic: Simple CTF

Task 1: Simple CTF

1. How many services are running under port 1000?

Answer: 2

1. What is running on the higher port?

Using -A will get more information.

There is FTP with anonymous login, a robot.txt file and SSH access.

Answer: SSH

1. What’s the CVE you’re using against the application?

Using gobuster to find out files/directories.

There is a /simple directory.

More information can be found here.

Answer: CVE-2019–9053

1. To what kind of vulnerability is the application vulnerable?

The application is vulnerable to SQL injection.

Answer: SQLi

1. What’s the password?

Download the script using wget

Then I can run python by using ***python2 exploit.y -u ***

Since I want to find the password I need to use the -c flag togetheer with the -w flag.

***python2 exploit.py -u -c -w /usr/share/wordlists/rockyou.txt***

Answer: secret

1. Where can you login with the details obtained?

Since we already have used ssh, let me try logging in.

Answer: SSH

1. What’s the user flag?

Directly run ls followed by cat user.txt.

Answer: G00d j0b, keep up!

1. Is there any other user in the home directory? What’s its name?

Since I am in mitch home dir, I need to go one dire up and list the folders.

Answer: Sunbath

1. What can you leverage to spawn a privileged shell?

Check the allowed commands for the user.

I got access to the vim shell.

Answer: Vim

1. What’s the root flag?

Use vim to gain root shell.

sudo vim -c ‘:!/bin/sh’

Answer: W3ll d0n3. You made it!