DC 6 Walkthrough

DC-6 CCTF Writeup#

Nmap Scan#

I started with an Nmap scan to identify open ports. The scan revealed that SSH and HTTP were open, with a WordPress instance running on the web server. The domain name was also displayed in the Nmap results.

WordPress Enumeration#

After performing enumeration on the WordPress site, I discovered 5 users. I attempted to brute force the passwords but was unsuccessful after trying nearly 30,000 passwords. I then consulted the man page on VulnHub and found a command to create a custom wordlist.

Using this wordlist, I successfully brute-forced the password for the user “mark”.

Gaining Access#

I logged in as mark but found no plugins or appearances for a reverse shell. I then checked the Activity Monitor for known exploits or vulnerabilities.

I discovered an RCE exploit on ExploitDB.

I set up the payload on my local server, made some code edits, and uploaded the site. Within seconds, I obtained a reverse shell.

User Enumeration#

I established the shell as a regular shell and began enumerating the machine. I found the password for the user “graham” and switched to that account.

Using sudo -l, I discovered that I could run the jens/backups.sh script. I also ran linpeas in parallel, revealing the MySQL user password for WordPress and all user hashes.

Privilege Escalation#

Focusing on privilege escalation through backups.sh, I edited the script and executed it as jens, gaining shell access as jens.

Using sudo -l, I found that I could run nmap with no password. I utilized this to escalate privileges to root and successfully obtained a root shell.

Author#

• Sagar Sehrawat

Adapted from sagar-sehrawat/VulnHub-Machine-Solutions under MIT.