CYBERHUB_CTF

OVA.rar This is cyberhub machine link:drive.google.com

CyberHub CTF — Introduction

The Story

Welcome to CyberHub CTF, a deliberately vulnerable web application designed to simulate a real-world penetration-testing scenario.

You have been given access to a target machine at:

192.168.56.101

At first glance, the server appears to host a normal web application. However, something is not quite right. A login portal is exposed, and behind it may be sensitive functionality, hidden files, misconfigurations, and vulnerabilities waiting to be discovered.

Your mission is to approach the target like a penetration tester:

Reconnaissance → Enumeration → Vulnerability Discovery → Exploitation → Privilege Escalation → Flag Collection

The objective is not simply to "hack" the machine. Instead, you must understand how each discovery leads to the next stage of the attack.

The journey begins with the authentication portal:

http://192.168.56.101/cyberhub-ctf/modules/auth/login.php

From this point, careful enumeration and analysis will reveal clues about the application and its underlying infrastructure.

Throughout the challenge, document every important finding, command, request, response, vulnerability, and decision. This walkthrough follows the attack path step-by-step and explains why each technique was used rather than simply listing commands.

Target Information

InformationDetailsCTF Name:CyberHub_CTFTarget IP192.168.56.101ApplicationCyberHub CTF Initial Entry Pointmodules/auth/login.phpEnvironmentLocal CTF/LabObjectiveDiscover vulnerabilities and capture the flags

Starting Point

The assessment begins with very little information about the target. Rather than immediately attempting exploitation, the first step is to perform reconnaissance and understand what services and applications are exposed.

Rule of the challenge:_ Don't attack blindly. Every piece of information discovered during enumeration can become a clue for the next stage._

Let's begin the journey.

Information Disclosure — Flag Discovery

On the dashboard.php page, I right-clicked and selected "View Page Source," where I inspected the HTML source code and discovered the Information Disclosure .

Hidden Directory Enumeration

Using Gobuster for web directory enumeration, based on the HTTP service identified during the Nmap scan, I discovered a hidden directory containing another CTF flag.

IDOR Vulnerability Testing

On the profile page, I manually tested different ID values by changing the ID parameter randomly; when I reached ID 3, the application returned another user's profile containing the IDOR flag, confirming the IDOR vulnerability.

File Upload Vulnerability — Profile

On the profile page, I tested the file upload functionality by uploading files with different extensions and renaming the file format to check whether the application properly validated the uploaded file type.

On the profile page, I tested the upload functionality using image formats (.jpg, .jpeg, .png, .gif, .webp), PHP/script formats (.php, .phtml, .php3, .php4, .php5, .phar, .inc), double extensions (.jpg.php, .png.php), and case variations (.PHP, .Phtml). Most formats were rejected, but .php3 was accepted, revealing a potential File Upload vulnerability.

Cross-Site Scripting (XSS) — Flag Discovery

In the About field, I entered the basic XSS payload <script>alert(1)</script>. The application processed the input as JavaScript and exposed the XSS flag, confirming a Cross-Site Scripting (XSS) vulnerability.

Hash Identification & Flag Validation

Inspected the About page source code, discovered a hidden hash, identified its hashing algorithm, recovered the plaintext in the authorized CTF environment, and validated the resulting flag.

• Directory Enumeration: Used Gobuster to discover hidden directories and files, including robots.txt and the .dict file.
• Information Disclosure: Checked robots.txt, which revealed the hidden .dict path; retrieved it using curl and found many candidate flags.

• Flag Identification: Analyzed the candidate list and matched the correct CYBERHUB{HASHING_...} flag according to the challenge requirements.Created hashflags.txt containing the candidate flag values, which can be used as a reference/wordlist during the CTF hash-cracking stage.
• Hash Cracking: Used John the Ripper with an appropriate wordlist to attempt recovery of the plaintext.

Steganography

• Directory Enumeration: Performed directory enumeration and discovered the /assets/ directory containing multiple image files.
• Image Analysis: Downloaded the images and analyzed each one using ExifTool and Steghide to identify hidden metadata or embedded information.
• Flag Discovery: During metadata analysis, the logo.webp image contained suspicious/hidden information revealed by ExifTool.
• Flag Validation: Extracted the discovered value from the metadata and verified it as the required CTF flag.

Reconnaissance

Target URL:http://192.168.56.101/cyberhub-ctf

Nmap scan cmd:-Nmap -sC -sV -sS -O -p- -Pn -T4 192.168.56.101

Identify:Open ports, Web server,Running Services, Service Versions.

Now,

FTP (Port 21) was found open, and anonymous login was enabled, allowing access without valid credentials.

SMB Enumeration

SMB ports 139 and 445 are open on the CyberHub CTF machine, enum4linux can be used to enumerate SMB/NetBIOS information such as workgroup/domain, users, shares, and system details.

Cmd:-enum4linux -a 192.168.56.101

Used enum4linux -a 192.168.56.101 to enumerate SMB information and identify valid usernames on the target system.

The hidden service on port 3344 revealed the clue /important/passwords.txt, indicating that password candidates could be found at this location.

Cmd:- curl -i http://192.168.56.101/cyberhub-ctf/important/passwords.txt

Using the enumerated username list and password list , Hydra was used against the SSH service on port 2222 to identify valid credentials.

SSH Authentication — Initial Access

During Nmap enumeration, the SSH service was identified running on port 2222 instead of the default port 22. Using the credentials arjun999 / secret241 discovered during enumeration, I connected to the SSH service with ssh -p 2222 arjun999@192.168.56.101 and successfully gained access to the target system in user mode.

Cmd:-ssh -p 2222 username@192.168.56.101

After obtaining user-level SSH access, I performed local enumeration and identified a privilege-escalation path that allowed me to escalate from arjun999 to root.

Cmd:- sudo /usr/bin/vim

opened vim page type text:- :!/bin/bash