Simple CTF — THM

1- Recon

- BVxBuster

i found a 3 endpoint all them 200 status else simple so i will start from there

in url i found a / after endpoint so i will fuzzing on it again to get more directorys hidden & found a CMS version i will search on it to show if have a exploit or no i found a CVE-2019–9053 on CMS version it's blind sqli

- Nmap

1- How many services are running under port 1000?

2

2- What is running on the higher port?

ssh

3- What's the CVE you're using against the application?

CVE-2019–9053

4- To what kind of vulnerability is the application vulnerable?

sqli

2- Exploitation

after got alotof information about target , now we have a critical vulnerability { SQLi } lets exploit it , now run script we found

python2 exploit.py http://targetip/simple -w /path/to/wordlists

python2 exploit.py http://targetip/simple -w /path/to/wordlists

nice but password is hash lets crack it , after tier i can't crack this hash but i got a user name and port 22 is open so lets do bruteforce to got password mitch

What's the password?

secret

now i have username , password and port 22 is open , so lets connect on it

Where can you login with the details obtained?

ssh

after login type /bin/bash

userFlag.txt

Is there any other user in the home directory? What's its name?

sunbath

3- Privilege Escalation

i type sudo -l to show if i can make anything on server by root permission without password

nice i found a vim i can control on it by root permission but how to got root user from vim??

after some search i found this site GFOBins and show on i can got root from vim , lets do it

open vim by sudo priv

and type in :shell and press enter

and type

sudo vim -c ':!/bin/sh'

sudo vim -c ':!/bin/sh'

Thanks For Reading :)