webdrv.root.sx

MrRobot CTF Writeup

Here's my writeup for the MrRobot CTF: First I checked out /robots.txt and found interesting stuff

I found the first key and a dictionary that we will use later.

Next I found a WPlogin page while fuzzing, I checked it out.

I tried naturally admin:admin

Then I tried the username elliot because of the MrRobot theme, and it gave me a different error message, so I knew that the username was valid.

After this I started cracking the password using the dictionary I found in the first step, and the username elliot.

After some time I managed to crack the password and log into the WP admin panel.

I go to the themes page and set up a reverse shell in the content.php file.

I set up a listener and got a shell.

After this I went to the /home/robot directory and found the flag which was not readable, but I found a hash.

I cracked the hash and escalated to the user robot, getting the user flag.

After this I try and escalate to root, searching for useful SUID bins and I found that /usr/local/bin/nmap had the SUID bit set, meaning it executed with elevated privileges.

After this I got root and the root flag.

THM Cheese CTF writeup

Here's my writeup for the THM Cheese CTF: The website lands on a page with some product offerings, there is also a login page. First I started fuzzing.

I found out that we can bypass the login page by using a simple SQL injection.

While fuzzing I found a page called secret-script.php. It had a =file parameter. LFI was possible.

Next I decoded the secret-script.php it was very simple. It had $file GET parameter.

I then found a messages.html page which pointed to PHP filter chain that led to rce.

Now I set up a listener and get a shell

Now out of all the files writeable one was the .ssh/authorized_keys, so naturally I injected my public key and got an escalated shell.

Now we got the user flag!

After this I checked SUID binaries. and systemctl services and found out /opt/xxd has root permissions. So I used it to read the root flag

THM Wgel CTF writeup

Here's my writeup for the THM Wgel CTF: The website lands on a default apache web server page. First I start with an nmap scan, finding only port 80, and 22.

Looking at the site's source code, I find a comment that says "Jessie don't forget to update the website" I tried looking up CVEs for apache 2.4.18, but I couldn't find anything useful. I also tried looking up exploits for apache 2.4.18, but I couldn't find anything useful either. Then after the fuzzing finished I found http://10.113.151.63/sitemap/.ssh/id_rsa which was a private SSH key. Next step was logging into the machine using the private key.

After logging in I found the user flag in /home/jessie/Documents/user_flag.txt

Next I had to escalate my privileges somehow, so I ran sudo -l, finding that wget could be run as root.

Using this to my knowledge, I try and send the root flag to myself using wget and ncat as a listener.

Here's where I send the root flag to myself

And just like that we got the root flag!