Lazy Admin — Try Hack Me CTF Challenge

Easy Hacking Challenge

Firstly, let’s initiate an NMAP scan:

Progressing forward, two pieces of information have been acquired: potential usage of SSH or HTTP protocols. Notably, there are vulnerabilities associated with each of these services. For instance, in the case of SSH, an identified vulnerability is as follows:

Now, let’s proceed to explore the contents of the web server:

Examination of the source code yielded no significant outcomes. It is advisable to deploy a tool like “Go Buster” for additional reconnaissance:

From the results of the directory bruteforcing, various folders were discovered, and it was identified that the CMS “SweetRice” is being utilized by the administrator. This knowledge may be leveraged for potential exploitation:

An intriguing MySQL backup was detected. This resource will be retrieved for subsequent analysis:

The extracted information includes a username, while the password remains obfuscated. It is essential to decipher the obscured password:

Subsequent decryption efforts will be undertaken 😄:

With access credentials secured, an exploration of the enumerated directories, as identified by Go Buster, reveals a specific access request:

Access has been granted! The next step involves uploading a reverse shell, which requires customization with the appropriate IP address. Note that a VPN is being employed, and the IP address within the “tun0” section is relevant:

Despite initial upload attempts failing, an alternative path via the “ads” section was successful. The subsequent process remains analogous:

With preparations complete, a designated port is listened on, facilitating the initiation of the reverse shell:

Upon successful connection, the initial “user.txt” flag is located within the “/home/itguy” directory. However, achieving root-level access necessitates a privilege escalation endeavor:

A notable “.pl” file is identified, which currently lacks root-level access. It holds potential for privilege escalation, achievable by substituting the IP address and port parameters:

With the adjusted “.pl” file ready, a new netcat listener is established on the specified port. This sets the stage for opening the modified Perl script:

At this point, root-level access is attained, facilitating the search for the root flag:

This concludes the steps needed to complete the CTF challenge.

If you liked it and want to see more, here’s another one: