Simple CTF TryHackMe

1) Intro 


2) How many services are running under port 1000? 

 

For this we can use simple nmap command which is nmap <IP-TARGET>

and as the question asked, we can see there are 2 services are running under port 1000. 


3) What is running on the higher port? 

ssh


4) What's the CVE you're using against the application? 

we will be using command gobuster dir -u <URL> -w <wordlist> to see if there is any directory we can access. 



here, the /simple directory can be accessed



as we scroll down, we can see version used by this cms, when it comes to something around "version", we can try to search any CVE associated with that version

In Exploit-DB we can see the exact CVE associated with the version as suspected. 

CVE-2019-9053


5) To what kind of vulnerability is the application vulnerable? 

sqli


6) What's the password? 

to know what password is being used, we need to download the exploit file first


then we need to put the file at /root


we then execute this command python2 46635.py -u http://10.201.65.172/simple/ -c -w /root/Desktop/Tools/wordlists/rockyou.txt

what this command do is basically perform an automated password-guessing / brute-force / credential attack against the login or form at /simple/, using rockyou.txt as candidate passwords.


After a while, it will show both username and its password. 

7) Where can you login with the details obtained? 

ssh


8) What's the user flag? 

Here we need to SSH into the mitch account at the target ip address

ssh mitch@<TARGET-IP> -p -2222


after that, we can see the file and its content



9) Is there any other user in the home directory? What's its name? 

First we identify our working directory and go to home directory to see if there is any other user aside from mitch



10) What can you leverage to spawn a privileged shell? 

for this we can user sudo -l to see what our user can do.

here we can see that user mitch can execute the vim command without password. 


11) What's the root flag? 

from the infromation we get from 10) we then go to GTFOBin, which is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.

we can search for vim here


we use this command to get into root. 


the question mentioned about root, so we try to see if there is anything under root, and as we suspected, we find the flag. 


Comments

Post a Comment

Popular posts from this blog

Data Exfiltrtation Detection (DNS, FTP, HTTP, ICMP)

Image
Learning Objectives In this entry, we will cover the following learning objectives: - Understand the common methods used for data exfiltration. - Learn how to detect exfiltration attempts using network traffic analysis. - Identify signs of exfiltration on endpoint devices. - Correlate logs in a SIEM to uncover hidden exfiltration channels. 1) Data Exfil: Overview Tech, and indicators -> unauthorized data transfer from in to out by adversaries -> can be by insider or malware 1.1) Why they do data exfil?  Reason Description Financial Gain Stolen data (e.g., credit card information, personal records) can be sold on the dark web or used for fraud. Espionage Nation-state actors target intellectual property, trade secrets, or classified information for strategic advantage. Ransomware & Extortion Attackers steal data and threaten to leak it unless a ransom is paid. Disruption & Sabotage Adversaries aim to damage an organization's reputation or operations by exposing sensitiv...
Read more

Firewall, WAF, and VPN manual log Analysis using command line.

Image
Incident Scenario Initech Corp, a mid-sized financial services company, has recently deployed a new firewall and intrusion detection system (IDS) to monitor its network perimeter. Over the past month, security analysts have noticed abnormal traffic patterns, but the SOC team has been overwhelmed and missed deeper analysis. As a new security analyst, you have been tasked with reviewing one month of perimeter logs to determine what techniques the adversary used, and whether they succeeded in breaching the perimeter. You have been given three sets of logs from the time of the incident. The logs can be found in the Perimeter_logs/challenge directory on the Desktop. Firewall Logs:firewall.log WAF Logs:ids_alerts.log  VPN Logs:vpn_auth.log  LOG ANALYSIS Let's start by exploring the logs, as shown below: Commandline: head firewall.log Explore ids logs, as shown below: Commandline: head ids_alerts.log Examine VPN Logs, as shown below: Commandline: head vpn_auth.log Reconnaissance atte...
Read more

Reversing ELF TryHackMe

Image
  1) crackme1 for the first challenge all we need to do is run the file named "crackme1" and we got the flag. 2) crackme2 when we try to run the file, it correct us and say the right usage is ./crackme2 + password, and we need to find this password. As we open the file in ghidra, we can see if we use "super_secret+password" it will give us access granted as the output. and as we suspected, once we use it as the password, it will give us the flag.  3) crackme3 The same case as crackme2, so first let's see if there is any interesting strings that we can see.  here we can see there is a base64 strings as we open the file in ghidra, it says that if we input the base64 strings as the password, then the password is correct.  so we decode the strings first and then use it as the password.  4) crackme4 This launches GDB (GNU Debugger) and loads the executable crackme4. This tells GDB to print all the functions found inside the binary. This lets you identify where the re...
Read more