---
# System prepended metadata

title: CTF Range-110
tags: [file upload, CVE-2021-4034, linux, CPENT]

---

# CTF Range-110
## Challenge 110
## Challenge 111
## Challenge 112
![image](https://hackmd.io/_uploads/SJMY-mTFxe.png)


* Nmap
    * ![image](https://hackmd.io/_uploads/Byzv7XaYex.png)

* The bookstore website, and found a admin login page, has week credential `admin/admin`
    * ![image](https://hackmd.io/_uploads/ryD6X7pFlg.png)
    * ![image](https://hackmd.io/_uploads/BJReEm6Kel.png)
    * ![image](https://hackmd.io/_uploads/r1UWE7Ttee.png)

* Successful add new book and upload the info php
    * ![image](https://hackmd.io/_uploads/HyHEUm6Klg.png)
    * ![image](https://hackmd.io/_uploads/B1NBIQatgl.png)

* Upload webshell and got shell as `cyberq_user`
    * ![image](https://hackmd.io/_uploads/SJFevXTFel.png)

* Using `john` cracked the password
    * ![image](https://hackmd.io/_uploads/ryhiDQ6Yle.png)
    * ![image](https://hackmd.io/_uploads/BJr3PXpFel.png)
    * `cyberq_user:smile`

* Wired variable path
    * ![image](https://hackmd.io/_uploads/r14XT46tle.png)

* Pwnkit
    * ![image](https://hackmd.io/_uploads/ryrIPXy9ee.png)


## Answer
* Challenge 110:`4.4.0-116`
* Challenge 111:`2cbe65d4`
* Challenge 112 :`d61e0a87`


