HackMD
I am among the organizers of this CTF and CTF author , In this writeup I'll be showing and explaining solving the two of the machines I made namely ; white and get leet 2 where White was a linux Ubuntu based Box and Get-Leet-2 was a Windows Based Box, Starting up with White which was the Linux!
WHITE
I'm just gonna go ahead fast with this LOL, we have port 80 and 22 open , checking on port 80 we have the apache page, So running gobuster with wordlist SecLists/Fuzzing/fuzz-Bo0om.txt and you get /secret/ which has index.php which is a rabbit hole so dirsearching inside the dir we find index.txt which carries credentials for a user named marce with password marce@2021, I now use the creds found to login with SSH to the machine, and we are in, Checking for user privileges :
So we are able to run the binary /usr/bin/escalator as sudo with marce :
Okay so we dont have the password! , now we have to reverse engineer the binary we pull it to our local machine using netcat , And then we reverse engineer it to understand how it behaves:
So as shown we have 2 functions which are suspicious and must be viewed : main and sym.PassVerify So let's start with main:
Yeah so we see it asks for password and then passes the inputted value to the function sym.PassVerify , So now let's disassemble the function:
As shown it is compared with 0x208d9 which is hex for 133337 , so let's try putting that as the password this time:
And there we have the flag !
GET LEET 2
This is a windows box , which is also apparently my first box made in windows hehe!
First did a quick nmap scan:
We have port 80 opened , 21 opened and ports which lead to SMB protocols and also 3389 which is used for processing RDP sessions!
So checking the port 80 on the web it brings the default IIS page , so I now perform Dirbusting , using gobuster to check if there are any hidden folders or files:
Found a directory named secret I decide to open it
but nothing specific was found but checking the source code I got :
<!--britney:br1t****--!>
which meant like some sort of creds but they didn't work of course on the SMB or any authorization, So I decide to dirbust again:
and we see users.txt , I now read it :
So we now have multiple passwords to guess for britney , I now try SMB with the creds:
it worked with the password br1tn3y@ and I see we have access to inetpub so I open inetpub to see if I can get any creds:
So far we got nothing inside wwwroot so I shift my working dir to temp:
we get a file inside there named rerun.bat , so I pull it to my system for a better understanding to what it does:
And here we see that it's somehow pulling from a db and outputing it to a log file with username as iiss and password as 11ss___ , so I now try accessing SMB using those creds:
and it worked , I now try accessing C which is odd, but britney couldn't access it:
But then remember the port that is opened 3389 it allows an RDP session so logging in with iiss credentials using remmina or directly from windows you are able to gain access to the desktop:
So we open the files and the start looking for flag, and eventually the flag will be found inside C:\Users\admin\Desktop\ but also will be found in C:\Temp\:
I hope you enjoyed every bit of the CTF challenges!
