December 27, 2024
Black Friday Cyber Monday CTF 4/5 writeup
Please note this is not a complete writeup — I did not get the final flag. I try to limit my time investment in CTFs as it is too easy to…
By Mark Finlay
8 min read
Please note this is not a complete writeup — I did not get the final flag. I try to limit my time investment in CTFs as it is too easy to lose days on them. I will list all the tips & guidance I received for that final question at the end of this article.
Thank you to The Safer Internet Project & e2 Cyber for running this CTF!
My preparation for a CTF always involves listing all the questions as they can often provide hints on what to look for.
Questions -
1.0 Please help us investigate the following websites to see which has vulnerabilities and is collecting data:
- perfectmonday.au
- highenergydigital.com
- airdeskr.com
- leeandson.com
The flag for this challenge is one specific website that is storing data.
2.1 From the previously investigated websites, which of them is storing critical client information in a poorly protected system, and how is it vulnerable to attack, and on which page is it vulnerable to this type of attack? The flag is the exploitation method name in the format "*** *********"
2.2 The flag is the page on which this code executes in the format "pagename.xxx"
3.1 After exploiting the vulnerabilities on the site, gain access to a database and follow through to find a specific user's credentials that might provide SSH access. The flag is the username.
3.2 The flag is the password of this user.
4.0 Using the found SSH credentials, follow through to the back end of the machine. Flag for this challenge is the IP Address of the server.
5.0 Congratulations on making it this far and accessing the system! Help us to remove other user's information by clearing the user table. Once you have completed this, you will be presented with a flag.
Hint (costs 15 points) — If you use your finger to feel around, you might find the answer!
Bonus 1 — Who is the vulnerable site working with? Flag is the URL including https://
Bonus 2 — Which other user accounts exist on the vulnerable machine? (Big credit for building a large part of this CTF).
Bonus 3 — Which monitoring tool is being used on the vulnerable machine to monitor traffic and vulnerabilities? Flag is the name of the monitoring tool.
Bonus 4 — What is the PHP version?
Bonus 5 — What is the database schema name?
Bonus 6 — What are the database columns? Flag is in format "name,name,name,name,name"
Bonus 7 — What database software is being used on this machine? Flag is the database software name.
Bonus 8 — What is the coupon code displayed when logging into the vulnerable machine?
Bonus 9 — What version of Linux is installed on the vulnerable machine?
Answers -
Looking at the questions, they indicate that there is a website running PHP, with a database that we need to enumerate via a website vulnerability. I will need SSH creds to access the server, access the database & clear the user's table.
I'm not expecting that extensive enumeration, scanning or brute forcing will be required. I imagine this will be more of a 'puzzle' to solve.
There is no penalty for guessing. You can try each of the websites to find the answer for 1.0. Given there is a database it seemed reasonable we would also be performing SQL injection — which is the answer to 2.1.
2.1 sql injection
In the Safer Internet Project discord General channel, there was a link to CTF live monitoring on YouTube — apologies for the grainy stream image. That is a Wazuh dashboard — Bonus 3.
Bonus 3 wazuh
perfectmonday.au - shopping site - most of the links don't go anywhere, the checkout & login isn't finished / functional.
highenergydigital.com - digital marketing site, submit a form, goes nowhere.
leeandson.com - jewellery site, unfinished links, submit a form, goes nowhere.
airdeskr.com - process of elimination - this is the answer to 1.0. SQL injection vulnerability found below to confirm.
1.0 - airdeskr.com
Viewing the page source of airdeskr.com revealed the answer of Bonus 1 in the footer — "an epic web design company" revealed who the site is working with:
Bonus 1 https://highenergydigital.com
The page source also revealed a login page:
Basic SQL injection test at the login page:
Resulted in displaying the following error — Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '--'' at line 1 in /usr/share/nginx/html/login.php:21 Stack trace: #0 /usr/share/nginx/html/login.php(21): mysqli->query('SELECT password...') #1 {main} thrown in /usr/share/nginx/html/login.php on line 21
From that error message we can answer 2.2 — the page on which the code executes, pagename.xxx, seen in URL & Bonus 7.
2.2 login.php
Bonus 7 — database software — MariaDB
We can conclude that the username field is vulnerable to SQL injection. I knew from Pentest+ / CEH courses that SQLMAP would likely be perfect for this scenario. I wanted a refresher on it so I turned to TryHackMe (fantastic resource) and completed the SQLMAP room — https://tryhackme.com/r/room/sqlmap . The methodology below is directly from that room.
We need to capture the POST request in Burpsuite, copy as file, name it req.txt
Now we can use our request with SQLMAP. What are the databases?
sqlmap -r req.txt -p username --dbs --level=5
-p = vulnerable parameter
--dbs = extract database
--level=5 = max level of tests / indepth scanssqlmap -r req.txt -p username --dbs --level=5
-p = vulnerable parameter
--dbs = extract database
--level=5 = max level of tests / indepth scans
- Bonus 5 — database name — countryroad
- Bonus 4 — PHP version — PHP 8.3.12
What are the tables?
sqlmap -r req.txt -p username -D countryroad --tables
-D = database name
--tables = extract tablessqlmap -r req.txt -p username -D countryroad --tables
-D = database name
--tables = extract tables
What are the column names in the users table?
sqlmap -r req.txt -D countryroad -T users --columns
-T = table name
--columns = extract column namessqlmap -r req.txt -D countryroad -T users --columns
-T = table name
--columns = extract column names
My next step was to dump the whole database. That was problematic during the event as it was very big, from memory greater than 500 rows. It was also apparent that the table was being populated by other users SQL injection queries. You would recognise their usernames from the leaderboard. I also realised that the database was filling from the start, so I downloaded the last 200 rows of the table as I wasn't able to get a complete database dump. It was a gamble that the "secrets" would be there as I hadn't identified anything of value from the start of the database. That proved correct. I utilised ChatGPT to help build the query & assist with errors — it is a useful tool.
After the CTF finished there were only 122 entries (default) so I dumped the whole database, this made it very easy, and I suspect I may have been able to perform this with a better internet connection or at a time with less people accessing the machine.
Opening the dump file —
Bonus 6 — database columns — this was trial & error — I have three different column orderings in the above two screenshots. I thought the users.csv order would have been correct, but the answer was as sqlmap found them.
Bonus 6 — username,password,FullName,PassportNum,Country
Perusing the dump file — users.csv the entry below was easy to spot. During the CTF I also found it easily, once I dumped the tail end of the database.
3.1 SSH username — ssh_admin
3.2 SSH password — getcreds123!
We have the SSH credentials — what is the IP address of the server? Many ways to discover this, couple of methods below.
4.0 Server IP address — 54.144.220.52
Let's SSH in.
ssh ssh_admin@54.144.220.52
getcreds123! when prompted
ls /homessh ssh_admin@54.144.220.52
getcreds123! when prompted
ls /home
The login banner completes 2 questions:
Bonus 8 — login code — 30OFF
Bonus 9 — Linux version — Amazon Linux 2
Bonus 2 — what other user exists on the machine — zeroxmk. Monitoring the discord channel ZeroXMK started giving clues & helping with queries once people started reaching question 5.0.
Bonus 2 — zeroxmk
Final Flag -
Initially there was a hidden text file in the ssh_admin home directory that contained something like "…don't be afraid to give yourself the finger". This was later removed and the hint added (at a cost of 15 points).
Checking the bash history showed multiple entries for the MYSQL login command. I wasn't the first user on the box so I can't determine what was originally present in the .bash_history file or if this was the intended discovery method, I simply worked with what I found.
cat .bash_history
The following series of commands demonstrates a method of clearing the users table. The users.csv file contained 122 rows of data. I believe at this point one of the requirements for spawning the flag should have been met.
During the CTF the following hints were given in the discord channel:
- flag appears in the terminal itself.
- the DB will reseed itself every 15 minutes.
- once you complete the challenge to clear out the DB, you have 15 min to find the flag for that challenge. There's a clue written in plain view somewhere on the box.
- once you clear it, you have 15 minutes to dig around for the flag before the table repopulates.
I explored & enumerated to the best of my ability. I could not find any hidden files related to the flag appearing. Up to this point the CTF felt like a great general skill test. Personally, I wasn't enjoying this final challenge & what the final process involved so I stepped away.
Once the event finished, I received several further hints:
- you needed to use finger and docker.
- middle-finger modem7 and you don't need sudo for it.
- you can also list the hidden files. That should show the one you're after.
- you have to do that within the container.
I ran middle-finger locally, opened a shell inside the container & looked around for hidden files — I couldn't find anything of note, which I didn't want to as that would invalidate clearing the database. I was not able to run middle-finger on the CTF server without sudo permissions. I decided not to pursue this further.
I expect I missed something obvious, or was a single command away from the finish, which is the nature of CTFs. Again, thank you to The Safer Internet Project & e2 Cyber for hosting this CTF. I look forward to the next one!