CTF on Blog

CyberChallengeIT CTF - Group Challenge

Mon, 01 Jan 0001 00:00:00 +0000

CyberChallengeIT CTF - Group Challenge

During the last week of preparation for che Cyber Challenge IT CTF, we were asked to do a CTF challenge our self. We were divided in groups and given a month to come up with a challenge.

Our group create an easy and guided challenge, since we were required to solve it in one hour. It will cover some basic aspect of all the kind of challenges types like Web Security, Reversing, Forensics, Cryptography.

Reply Challenge 2020 - That's what server says

Mon, 01 Jan 0001 00:00:00 +0000

Reply Challenge 2020 - That’s what server says

This is the Writeup for the 300 points Web challenge for Reply Challenge CTF. During the CTF I and my team achieved first blood on this challenge. The challenge consists of finding a service endpoint on a web page, with a login API. Then you have to exploit an XXE (XML External Entities) Injection to get an LFI (Local File Inclusion) to get the sysadmin credentials to login on the service and get the flag.

TryHackMe - Blue

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Blue

The room link can be found at TryHackMe - Blue

For this room, I will be using the Metasploit framework.

Recon

We begin with a Nmap of the box to see the services and get their version.

msf5 > db_nmap -sC -sV 10.10.47.219

Now we can see all the running services with the services command.

msf5 > services
Services
========

host           port   proto  name               state  info
----           ----   -----  ----               -----  ----
10.10.47.219   135    tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   139    tcp    netbios-ssn        open   Microsoft Windows netbios-ssn
10.10.47.219   445    tcp    microsoft-ds       open   Windows 7 Professional 7601 Service Pack 1 microsoft-ds workgroup: WORKGROUP
10.10.47.219   3389   tcp    ssl/ms-wbt-server  open
10.10.47.219   49152  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49153  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49154  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49158  tcp    msrpc              open   Microsoft Windows RPC
10.10.47.219   49160  tcp    msrpc              open   Microsoft Windows RPC

On this machine, we will focus on the SMB service which is on port 445.

We can gather more information using the module auxiliary/scanner/smb/smb_version. Running it the services page will lock more like this.

10.10.47.219  445    tcp    smb                open   Windows 7 Professional SP1 (build:7601) (name:JON-PC) (workgroup:WORKGROUP ) (signatures:optional)

Also we run auxiliary/scanner/smb/smb1 to check if the box has support for SMBv1.

msf5 auxiliary(scanner/smb/smb1) > run

[+] 10.10.47.219:445      - 10.10.47.219 supports SMBv1 dialect.
[*] 10.10.47.219:445      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

As the machine name implies the box could be exploitable via EternalBlue. Since the machine has Windows 7 installed and SMBv1 enabled, it is most likely vulnerable. You can read more here Microsoft - EternalBlue.

We can check if the machine is vulnerable by running the module auxiliary/scanner/smb/smb_ms17_010.

msf5 auxiliary(scanner/smb/smb_ms17_010) > run

[+] 10.10.47.219:445      - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.47.219:445      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

TryHackMe - Easy Peasy

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Easy Peasy

The room link can be found at TryHackMe - Easy Peasy

Enumeration

First we scan for open ports and services

Nmap

We use nmap with some default arguments.

sudo nmap -sV -sC -oA nmap/first $IP

It will return.

PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.16.1
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: nginx/1.16.1
|_http-title: Welcome to nginx!

From the first scan we can see that port 80 is open with nginx version 1.16.1

TryHackMe - Vulnversity

Mon, 01 Jan 0001 00:00:00 +0000

TryHackMe - Vulnversity

The room link can be found at TryHackMe - Vulnversity

Reconnaissance

Nmap

First, we do a simple Nmap scan

nmap $IP
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3128/tcp open  squid-http
3333/tcp open  dec-notes

We find six ports open, we can now make a more in-depth scan with nmap -sC -sV $IP. It will found the service type and version.