System-Host Based Attacks CTF 2

System/host-based attacks target the underlying operating system or individual hosts within a network to compromise their security. These attacks exploit vulnerabilities in the system's configuration, software, or hardware to gain unauthorized access, escalate privileges, or disrupt the normal functioning of the host. Common techniques include exploiting unpatched software vulnerabilities, misconfigurations, weak passwords, and malware infections. Attackers may attempt to gain root or administrator privileges to manipulate or steal sensitive data, install backdoors, or cause system crashes. System/host-based attacks can lead to significant breaches if not detected and mitigated promptly, making it essential for organizations to regularly update software, implement strong security policies, and monitor for suspicious activity to protect their systems from these threats.

This lab is designed to test your knowledge and skills in performing system/host-based attacks on Linux targets and identifying hidden information on a target machine.

In this lab environment, you will be provided with GUI access to a Kali Linux machine. Two machines are accessible at http://target1.ine.local and http://target2.ine.local.

Objective: Perform system/host-based attacks on the target and capture all the flags hidden within the environment.

Flags to Capture:

Flag 1: Check the root ('/') directory for a file that might hold the key to the first flag on target1.ine.local.
Flag 2: In the server's root directory, there might be something hidden. Explore '/opt/apache/htdocs/' carefully to find the next flag on target1.ine.local.
Flag 3: Investigate the user's home directory and consider using 'libssh_auth_bypass' to uncover the flag on target2.ine.local.
Flag 3: Investigate the user's home directory and consider using 'libssh_auth_bypass' to uncover the flag on target2.ine.local.
Flag 4: The most restricted areas often hold the most valuable secrets. Look into the '/root' directory to find the hidden flag on target2.ine.local.

┌──(root㉿INE)-[~]
└─# nmap -p- --min-rate=10000 target2.ine.local
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-07 20:54 IST
Nmap scan report for target2.ine.local (192.25.122.4)
Host is up (0.000025s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 02:42:C0:19:7A:04 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.36 seconds


┌──(root㉿INE)-[~]                                                                                                                                                                                                                          
└─# nmap -sC -sV -p22 target2.ine.local                                                                                                                                                                         
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-07 20:54 IST                                                                                                                                                                          
Nmap scan report for target2.ine.local (192.25.122.4)                                                                                                                                                                                       
Host is up (0.000057s latency).                                                                                                                                                                           
PORT   STATE SERVICE VERSION                                                                                                                                                                                                                
22/tcp open  ssh     libssh 0.8.3 (protocol 2.0)                                                                                                                                                                                            
| ssh-hostkey:                                                                                                                                                                                                                              
|_  2048 31:e2:1d:f1:b2:39:0c:a3:ec:db:01:4a:eb:a2:39:c7 (RSA)                                                                                                                                                                              
MAC Address: 02:42:C0:19:7A:04 (Unknown)                                                                                                                                                                                                    
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .                                                                                                                                              
Nmap done: 1 IP address (1 host up) scanned in 0.45 seconds   

msf6 > search libssh

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  auxiliary/scanner/ssh/libssh_auth_bypass  2018-10-16       normal  No     libssh Authentication Bypass Scanner
   1    \_ action: Execute                      .                .       .      Execute a command
   2    \_ action: Shell                        .                .       .      Spawn a shell