Boiler CTF
Boiler CTF is a simple challenge with lots of enumeration to do.
As always we start with sudo nmap -sC -sV -p- -oN scan.txt $IP
and we get an output like this
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.9.166.168
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 1
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
10000/tcp open http MiniServ 1.930 (Webmin httpd)
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
55007/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 e3:ab:e1:39:2d:95:eb:13:55:16:d6:ce:8d:f9:11:e5 (RSA)
| 256 ae:de:f2:bb:b7:8a:00:70:20:74:56:76:25:c0:df:38 (ECDSA)
|_ 256 25:25:83:f2:a7:75:8a:a0:46:b2:12:70:04:68:5c:cb (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelLet's begin with the first question
File extension after anon login
As we can see from the nmap scan, FTP allows anonymous logins.
Logging in and listing the directory we can see nothing.
This means the file is hidden. Simply do ls -lahs and it will list all contents (hidden ones too) in a list format.
Awesome, we can see that there is a hidden info.txt file. With this we get the answer to the first question.
Reading the contents inside the info.txt file we see a small text that's odd but it's in perfect form of a sentence.
This must be some sort of cipher, in fact it's the simple ROT13 cipher.
You can decode it online to see that the text says.
Moving on to the second question
What is on the highest port?
Simply look at the nmap scan and you will find the answer.
What's running on port 10000?
Again, check the nmap scan.
Can you exploit the service running on that port? (yay/nay answer)
To answer this, simply enumerate the service and see if you can find anything.
Try reading the source, do another nmap scan, run gobuster and nikto to see if you can find anything.
What's CMS can you access?
Access the webpage, we are greeted with the default Apache page. This means we have to enumerate in order to find the hidden page.
Reading the robots.txt file we find a few directories that are of no use, however one thing sticks out
This one was a little bit tricky to figure it out, however after googling around you have to do a little bit of conversion.
ASCII -> Base64 -> MD5 and you'll decode the text.
After that we start gobuster to search for hidden content.
From the results we get
After accessing the /joomla directory we are greeted with the default page of Joomla.
First lets start with Joomscan (https://github.com/OWASP/joomscan) and see what we can dig out.
From joomscan we get pretty much nothing except the version that Joomla is running on and the default directories. [++] Joomla 3.9.12dev
I couldn't find anything useful online to exploit that version of Joomla.
Keep enumerating, you'll know when you find it.
Let's continue with gobuster and see what we can find further.
Looking at what we found, the /_test directory seems out of place.
Looking the webpage we see that it is sar2html.
Searching online for sar2html exploits we find https://www.exploit-db.com/exploits/47204
It tells us that we can do Remote Code Execute through the ?plot= variable.
http://$target_ip/joomla/_test/index.php?plot=;<command>
Running ls will list the directory where it is located in the Select Host field.
Lets try to get a reverse shell.
Start netcat on our machine.
Grab a reverse shell from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md (I used python)
And paste the command in the URL.
After that we are in.
Stabilize shell!
Now once you're in, always stabilize your shell! Run these commands below.
This will spawn you in a bash shell. Then
This will allow you to clear your terminal. After that background shell with Ctrl + Z.
And in your own shell type
This will allow you to use tab completion and the arrow keys.
fg will return you back to your shell and just press Enter.
The interesting file name in the folder?
Listing the current directory we see an interesting file.
Reading the contents of the file we can see that there was an SSH server running and we can see the user basterd that logged in with their password!
You can complete this with manual enumeration, but do it as you wish
Where was the other users pass stored(no extension, just the name)?
Once we acquired the credentials for the user we can login and go to the /home directory.
We do not have permission to go to stoner so lets go to our directory and see what we got there.
Where was the other users pass stored(no extension, just the name)?
Reading backup.sh we can find the credentials to the other user and login.
user.txt
It's in the users home directory.
What did you exploit to get the privileged user?
Now let's try to get root.
Running
We can see nothing but a little joke. Let's start up LinEnum (https://github.com/rebootuser/LinEnum)
I copied the code and created the script in /tmp/enum.sh and executed it with bash.
One of the interesting things that LinEnum found is
Awesome! find has a SUID bit set and we can run it to get a root shell.
We can find out how to exploit it from https://gtfobins.github.io/
root.txt
It's located in /root.
Final Thought
Boiler CTF was quite an easy challenge rated as Medium difficulty. I had fun doing this challenge, especially discovering the sar2html exploit.
Last updated