Synopsis

My first CTF !

Platform

TryHackMe 

Level

Medium

Tools

• nmap
• GoBuster
  
• SQLmap
• php-reverse-shell
• hexeditor
• Bash

Questions

What is Flag 1?

I started by performing an Nmap scan against the target and found two open ports: 22 and 80

When browsing to the target IP, I noticed that the website expected a hostname rather than the IP address. I added olympus.thm and the target IP to my /etc/hosts file, allowing me to access the website successfully.

I began enumerating the web application with Gobuster and discovered a directory named /~webmaster.

After reviewing the page, it appeared to be an older version of the website. The most interesting feature was a login page. Since the challenge instructions specifically stated that brute forcing was out of scope, I decided to investigate the login section for SQL injection instead.

To test for SQL injection, I captured the login request using Burp Suite, saved it to a request file, and supplied it to sqlmap.

Using sqlmap, I identified a MySQL database named olympus.

sqlmap -r olympus.txt -p user_name,user_password,login --dbs --batch

Next, I enumerated the database tables and identified two that looked particularly interesting:

• flag
• users

Dumping the flag table immediately revealed the first challenge flag.

sqlmap -r olympus.txt -p user_name,user_password,login --dbms=mysql --technique=T -D olympus -T flag --dump --batch

What is Flag 2?

I then dumped the users table and extracted the usernames, password hashes, and email addresses.

sqlmap -r olympus.txt -p user_name,user_password,login --dbms=mysql --technique=T -D olympus -T users -C user_name,user_password,user_email --dump --batch

I decided to start with the first user, Prometheus. After converting the hash into a format supported by John the Ripper, I successfully recovered the plaintext password and logged into the CMS.

Inside the CMS, I noticed that posts could include uploaded images. Since the application was running PHP, my first thought was to upload a PHP reverse shell disguised as an image.

Before creating the payload, I needed to determine where uploaded files were stored. After additional enumeration, I discovered an administrator page:

/~webmaster/admin/includes/admin_add_post.php

Testing the upload functionality revealed that images were stored under:

/~webmaster/admin/img/

I configured the PHP reverse shell with my tun0 IP and listening port, renamed the file with a .png extension, and modified the file by adding valid PNG magic bytes (89 50 4E 47) using a hex editor.

After uploading the payload and publishing the post, I started a Netcat listener and browsed directly to the uploaded file. The payload executed successfully and spawned a reverse shell.

With shell access established, I enumerated the filesystem and discovered that I could read the second flag within the zeus user's home directory.

What is Flag 3?

I wanted to gain an interactive shell as that user.

Searching for SUID binaries owned by zeus revealed an interesting executable:

find / -user zeus -perm /4000 2>/dev/null

The binary could be abused to copy Zeus's SSH private key. After transferring the key to my local machine, I attempted to authenticate but discovered it was protected with a passphrase.

I converted the key using ssh2john and cracked the passphrase with John the Ripper. Once the passphrase was recovered, I successfully authenticated as zeus via SSH.

As the zeus user, I continued searching for privilege escalation opportunities and eventually discovered a hidden directory owned by Zeus.

Inside the directory was a PHP file containing code that referenced an executable with the SUID bit set. Reviewing the code revealed the exact command needed to execute the binary.

Executing the command spawned a root shell, allowing me to retrieve the third challenge flag.

uname -a; w; /lib/defended/libc.so.99

What is Flag 4?

After obtaining root, the challenge displayed a message hinting that an additional hidden flag remained on the system. The only clue provided was to use regex.

Since I already knew the format of the flags, I searched every file on the system for the pattern:

find / -type f -exec grep -H "flag{" {} + 2>/dev/null

After searching through the filesystem, I located the final hidden flag within:

/etc/ssl/private/.b0nus.fl4g

What I Learned

This machine marked an important milestone as it was the first medium-difficulty CTF that I completed successfully. Compared to the easier machines, this challenge required much more thorough enumeration and the ability to chain multiple techniques together to reach the final objective.

One of the new techniques I learned was how to leverage cputils to retrieve another user's SSH private key. After recovering the key, I used ssh2john and John the Ripper to crack the passphrase, allowing me to authenticate as the next user and continue the attack chain.

Another valuable lesson was the importance of reviewing source code carefully during privilege escalation. While examining a PHP file, I noticed it referenced another executable that had the SUID bit set. Understanding what the code was doing led me to execute the referenced binary, which spawned a root shell and allowed me to complete the challenge.

This machine reinforced that successful privilege escalation often comes from carefully analyzing the tools, scripts, and code already present on the system rather than relying on a single exploit.