TryHackMe "Simple CTF"
April 21st, 2023
Introduction
Simple CTF is an easy room released on August 18th, 2019 by MrSeth6797.
User Own
How many services are running under port 1000?
Nmap scan:
There are 2 services running under port 1000, those being FTP on port 21 and HTTP on port 80.
What is running on the higher port?
The highest port is port 2222, with SSH communicating on that port.
What's the CVE you're using against the application?
Running ffuf to find subdirectories:
Going to http://10.10.xx.xx/simple/ shows the system is running CMS Made Simple.
http://10.10.xx.xx/simpleThe bottom of the page reveals the version of CMSMS to be 2.2.8. This version of CMSMS is vulnerable to CVE-2019-9053.
To what kind of vulnerability is the application vulnerable?
The description of CVE-2019-9053:
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
CVE-2019-9053 uses SQL injection, also known as SQLi.
What's the password?
Using this Python script utilizing CVE-2019-9053, we can extract the salt, username, email, and password of the system.
The Python script determines the password to be secret.
Where can you login with the details obtained?
Password reuse is common, and the password obtained from before can be reused for SSH.
What's the user flag?
The user flag is located in mitch's home directory.
Inside user.txt is the user flag, G00d j0b, keep up!
System Own
Is there any other user in the home directory? What's its name?
Looking at the /home directory shows another user, sunbath.
What can you leverage to spawn a privileged shell?
Using sudo -l:
We can run Vim as root. If we can edit anything as root, we can change the password of a privileged user in /etc/shadow to login as them.
Using mkpasswd -5 will create a password from input encrypted with md5crypt in a format acceptible by /etc/shadow. We can replace the password for sunbath with the newly created password.
sunbath's current password in /etc/shadow can be replaced with the newly generated password with sudo vim /etc/shadow.
sunbath can then be logged in with su sunbath.
What's the root flag?
The root flag is located in /root.
Inside root.txt is the root flag, W3ll d0n3. You made it!.
And that's the room!
Last updated