Canto Write-Up

Introduction

In this write-up, I will guide you through the steps I took to complete the HackMyVM - Canto CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video here (to be updated).

TL;DR

Reconnaissance

Network/Port Scanning (Nmap)

Command:

Explanation:

  • nmap: Tool used to scan network and ports to discover which services are running.

  • -sV: Perform version detection of services.

  • -sC: Scan using default scripts.

  • -oA: Output in filename "canto".

  • 172.16.100.9: IP address of Canto VM on my network.

Output:

Findings:

We see that there is a web server running on port 80.

Let's check out the web server and in the background we can run gobuster to brute force web directories.

Directory Brute-forcing (Gobuster)

Command:

Note: I have setup an alias to run gobuster inside a docker container.

Alias: alias gobuster='docker run -it --rm --name gobuster -v /home/ayush/Tools/SecLists/:/SecLists ghcr.io/oj/gobuster'

Explanation:

  • dir: Mode of operation indicating directory/file enumeration.

  • -u http://172.16.100.9: Base URL of the target web server to scan.

  • -w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt: Base URL of the target web server to scan.

  • -x php,txt,html: Search for the PHP, HTML and TXT file extensions.

Output:

Findings:

The directories show that the web server is running Wordpress.

Enumerating WordPress (wpscan)

Command:

Explanation:

  • --url http://172.16.100.9/: Do all simple enumeration (-U -S -G -P -r -o -n -i).

  • --detection-mode aggressive: IP of the target samba server to enumerate.

  • --enumerate u,vt,tt,vp:

  • --plugins-detection aggressive:

Output:

Findings:

  • A user erik was found.

  • A vulnerable plugin canto was found which allows Remote File Inclusion and Remote Command Execution.

Visiting Web Page (Port 80)

This is a normal landing page with no special features. There is no extra information in the source code.

Exploiting The Vulnerability

Finding Exploit File

Let's search the ExploitDB to look for an exploit of the vulnerable plugin.

Command:

Output:

We will use the 3rd exploit as that is the one that is relevant in our case.

Get the path of the exploit and copy it to your current directory.

Command:

Output:

Running The Exploit

Let's understand how the exploit works.

Command:

Output:

I made a copy of the exploit file so that I can directly copy the commands given in the example.

We can give a PHP Reverse Shell file as an argument to the exploit. So let's do that.

Download the reverse shell from https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php.

Make the necessary changes in the code as shown.

Now, our exploit is ready with the reverse shell. We start our listener.

Command:

Now we exploit.

Command:

Output in listener:

First thing we do, is upgrade the shell.

User (erik) Access

During our WordPress enumeration we had found an user erik. On checking out his /home/erik directory we find a notes directory that has some files in it:

This means we have to find that backups folder. So we search for a backups in the file system.

Command:

Explanation:

  • find /: The find command, used to search for files and directories. The / indicates that the search should start from the root directory and include all directories and subdirectories under it.

  • -name *backups*: Match the pattern *backups*.

  • -type d: Restricts the search to directories only.

  • 2>/dev/null: This part redirects error messages to /dev/null.

Output:

Findings:

The last directory /var/wordpress/backups is the one we will checkout first because that seems like the most relevant.

On checking out this directory we find a text file with the credentials of erik.

Command:

Output:

Now that we have the password for the erik user, we can now try SSH.

Command:

Output:

Read the user.txt file to get the flag:

Privilege Escalation

Let's checkout the sudo permissions we have for erik. Command:

Output:

Findings:

We see that we can run the program /usr/bin/cpulimit with sudo permissions.

On checking GTFOBins we see that there is an entry for the cpulimit program and we can use it to elevate privileges.

Command:

Output:

And thus we have root.

And finally, we can read the root flag:

PreviousBreakout Write-UpNextConnection Write-Up

Last updated