> For the complete documentation index, see [llms.txt](https://mr-ghost.gitbook.io/simple-ctf-tryhackme/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mr-ghost.gitbook.io/simple-ctf-tryhackme/simple-ctf.md).
# Simple CTF
## 1.How many services are running under port 1000?
* #### First, we need to perform a port scan, and for that, we can use Nmap. We can use the '-sS' flag for stealth scanning and the '-sV' flag to determine the version of services running on the scanned ports.
### ANS:- 2
## 2.What is running on the higher port?
### ANS:- SSH
## 3.What's the CVE you're using against the application?
* #### First, we need to enumerate the target website. We can use Dirsearch for this, and specify the URL with the '-u' flag.
* #### After scanning, we found the '/simple' endpoint, which indicates the presence of a website. We also found a CMS service application at the bottom of the page, and its version was identified as 2.2.8.
* #### We searched for this version on ExploitDB and found an SQL injection exploit.
* #### To download the exploit, we can use 'searchsploit -m', which allows us to download exploits using the command line interface.
### ANS:- CVE-2019-9053
## 4. To what kind of vulnerability is the application vulnerable?
### ANS:- Sqli
###
## 5. What's the password?
*
```
```
* #### Here, we found a CVE that we could exploit. We downloaded the corresponding program and ran it, which allowed us to discover the password. To run the program, we used the '-u' flag to specify the URL (e.g. ), and the '-w' flag to provide a wordlist for the program to use.
### ANS:- secret
## 6. Where can you login with the details obtained?
### ANS:- SSH
## 7.What's the user flag?
* #### Okay, we successfully logged in using SSH. We can use the 'ls' command to list the files and directories on the system, and we found a file named 'user.txt'
### ANS:- G00d j0b, keep up!
## 8. Is there any other user in the home directory? What's its name?
### ANS:- sunbath
## 9. What can you leverage to spawn a privileged shell?
* #### When we ran 'sudo -l', we found that we have permission to run '/usr/bin/vim' with root privileges
### ANS:- VIM
## 10.What's the root flag?
* #### To escalate our privileges, we used GTFOBins to find a way to take advantage of our 'vim' permissions. We copied the path '/usr/bin/vim' and searched for it on GTFOBins, which gave us the command 'sudo vim -c ':!/bin/sh''. By running this command, we were able to gain a root shell.
### ANS:- W3ll d0n3. You made it!
