Certified Penetration Testing Specialist (CPTS)

I'm Osama Hegazi, and I've decided to complete the CPTS (Certified Penetration Testing Specialist) path from Hack The Box.

After completing each module, I'll solve the final lab and write a detailed walkthrough explaining how I approached the challenges, the techniques I used, and the things I discovered along the way.

My goal is not only to complete the CPTS path, but also to create write-ups that can help anyone following the same path understand the concepts, learn new techniques, and approach similar challenges more effectively.

If you're also working toward CPTS, I hope these write-ups can make your journey easier and give you another perspective on solving the labs.

Let's start the journey. 🔥

After starting the machine, Hack The Box provides me with the IP address of the target machine.

So, let's start by scanning the target using Nmap to find the open ports, the services running on them, and their versions.

nmap -sV -sC -Pn 10.129.189.188

nmap -sV -sC -Pn 10.129.189.188

• -sV → detects service versions.
• -sC → runs Nmap's default scripts.
• -Pn → skips host discovery and treats the target as online.

As we can see, there are two open ports: 22 and 80. We can also see the services running on these ports and their versions, which will help us during our testing.

Let's try to get more information about the web application using the WhatWeb tool.

whatweb 10.129.189.188

whatweb 10.129.189.188

There is no more useful info in this result.

After analyzing the source code, I noticed that we need to add the hostname to our /etc/hosts file.

This will allow us to access the website using the hostname instead of the IP address.

Now we are ready to start looking for a vulnerability that can help us get the flag.

During the Nmap scan, I noticed that there is an admin page from the robots.txt file, so I tried to access it.

Before trying to brute-force the login page, let's first try some common default credentials, such as

• admin:admin
• admin:password
• admin:password123

Surprisingly, the default credentials worked:

admin:admin

admin:admin

We can now log in to the admin panel and continue our testing.

After checking the admin page, I found that the website is running GetSimple CMS version 3.3.15.

Now we can search for known vulnerabilities affecting this version.

Using SearchSploit and Metasploit, I found an exploit for this version of GetSimple CMS.

I will use the following Metasploit exploit:

use exploit/multi/http/getsimplecms_unauth_code_exec

use exploit/multi/http/getsimplecms_unauth_code_exec

This exploit targets GetSimple CMS and may allow us to execute code on the target.

Let's run the exploit after setting the required options.

First, we set:

• RHOST → the target IP
• RPORT → the target port
• LHOST → our IP address
• LPORT → our listening port

After setting these options, we can run the exploit.

Here we got a shell on the web server of the vulnerable website.

Now we can get the user flag:

First, let's try to upgrade our shell from a nologin shell to a Bash shell so we can interact with the system more easily.

After that, we will try privilege escalation to gain root access and find the root flag. After that we will try to privilege our escalation to find the root flag

I tried many ways to discover vulnerabilities that could help me escalate my privileges.

find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null
uname -a
sudo -l

find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null
uname -a
sudo -l

During the enumeration, I found something interested.

I can run any PHP file without needing a root password

Let's exploit this misconfiguration using the following command:

sudo /usr/bin/php -r 'system("/usr/bin/bash");'

sudo /usr/bin/php -r 'system("/usr/bin/bash");'

Guess what? It worked! We now have a root shell.

We can read the root flag now.

I hope you learned something new today.

See you soon in another lab! 🔥