> For the complete documentation index, see [llms.txt](https://mr-ghost.gitbook.io/simple-ctf-tryhackme/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mr-ghost.gitbook.io/simple-ctf-tryhackme/simple-ctf.md).

# Simple CTF

<figure><img src="/files/7ME1swd9ClPj6kxbvJUm" alt=""><figcaption></figcaption></figure>

## 1.How many services are running under port 1000?

<figure><img src="/files/764uz719m4ZTl4NPuLUp" alt=""><figcaption></figcaption></figure>

* #### First, we need to perform a port scan, and for that, we can use Nmap. We can use the '-sS' flag for stealth scanning and the '-sV' flag to determine the version of services running on the scanned ports.

### ANS:- 2

## 2.What is running on the higher port?

### ANS:- SSH

## 3.What's the CVE you're using against the application?

* #### First, we need to enumerate the target website. We can use Dirsearch for this, and specify the URL with the '-u' flag.

<figure><img src="/files/9LKsUOaiAMvzeiXMOFAO" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/9Ryfdy8MdFDMWLoNxQei" alt=""><figcaption></figcaption></figure>

* #### After scanning, we found the '/simple' endpoint, which indicates the presence of a website. We also found a CMS service application at the bottom of the page, and its version was identified as 2.2.8.

<figure><img src="/files/Qfx9nyl7mzmfxkUq6Y8X" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/dWxOVhblPtPwtChSGoVd" alt=""><figcaption></figcaption></figure>

* #### We searched for this version on ExploitDB and found an SQL injection exploit.

<figure><img src="/files/wv4SzlJAy9SQpKQPXoQB" alt=""><figcaption></figcaption></figure>

* #### To download the exploit, we can use 'searchsploit -m', which allows us to download exploits using the command line interface.

<figure><img src="/files/gvHcMZALUMQ3t8uAsCaZ" alt=""><figcaption></figcaption></figure>

### ANS:- CVE-2019-9053&#x20;

## 4. To what kind of vulnerability is the application vulnerable?

### ANS:- Sqli

### &#x20;

## 5. What's the password?

*

```
<figure><img src="/files/Pdws9vjFB3uF3zWSEsqd" alt=""><figcaption></figcaption></figure>
```

* #### Here, we found a CVE that we could exploit. We downloaded the corresponding program and ran it, which allowed us to discover the password. To run the program, we used the '-u' flag to specify the URL (e.g. <https://IP/simple>), and the '-w' flag to provide a wordlist for the program to use.

### ANS:- secret

## 6. Where can you login with the details obtained?

### ANS:- SSH

## 7.What's the user flag?

<figure><img src="/files/lXLKJMUU2pPD7DEXMBJW" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5Msb94Uzg9a6m1J1Ecv7" alt=""><figcaption></figcaption></figure>

* #### Okay, we successfully logged in using SSH. We can use the 'ls' command to list the files and directories on the system, and we found a file named 'user.txt'

### ANS:- G00d j0b, keep up!

## 8. Is there any other user in the home directory? What's its name?

### ANS:- sunbath

## 9. What can you leverage to spawn a privileged shell?

* #### When we ran 'sudo -l', we found that we have permission to run '/usr/bin/vim' with root privileges

<figure><img src="/files/s7hCoG7ynG0U2SXtHcBJ" alt=""><figcaption></figcaption></figure>

### ANS:- VIM

## 10.What's the root flag?

* #### To escalate our privileges, we used GTFOBins to find a way to take advantage of our 'vim' permissions. We copied the path '/usr/bin/vim' and searched for it on GTFOBins, which gave us the command 'sudo vim -c ':!/bin/sh''. By running this command, we were able to gain a root shell.

<figure><img src="/files/wHTbFSwahHIw0KdRm88u" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/cyPjfbShNCcYd8uYewrw" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/C7POlAl0idxNslGVPcSB" alt=""><figcaption></figcaption></figure>

### ANS:- W3ll d0n3. You made it!&#x20;