Gift Write-Up

Introduction

In this write-up, I will guide you through the steps I took to complete the HackMyVM - Gift CTF challenge. The objective is to gain root access to the target machine by exploiting identified vulnerabilities. Checkout the video here (update this).

TL;DR

Reconnaissance

Network/Port Scanning (Nmap)

Command: 

nmap -sV -sC -vv -oA gift 172.16.100.13

Explanation:

  • nmap: Tool used to scan network and ports to discover which services are running.

  • -sV: Perform version detection of services.

  • -sC: Scan using default scripts.

  • -oA: Output in filename "gift".

  • 172.16.100.13: IP address of Gift VM on my network.

Output:

Findings:

We see that there is a web server running on port 80.

Let's check out the web server and in the background we can run gobuster to brute force web directories.

Directory Brute-forcing (Gobuster)

Command:

Note: I have setup an alias to run gobuster inside a docker container.

Alias: alias gobuster='docker run -it --rm --name gobuster -v /home/ayush/Tools/SecLists/:/SecLists ghcr.io/oj/gobuster'

Explanation:

  • dir: Mode of operation indicating directory/file enumeration.

  • -u http://172.16.101.13: Base URL of the target web server to scan.

  • -w /SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt: Path of word list to use.

  • -x php,txt,html: Search for the PHP, HTML and TXT file extensions.

Output:

Findings:

Nothing is found here.

Visiting Web Page (Port 80)

This is a normal landing page with no special features. Let's check the source code for any hints.

Source code of webpage:

The author of the box is saying that the box is really simple and there are no running services which we can exploit, and the web server only has a static page. So, the simplest way to get access to a system is brute forcing.

Brute Forcing

SSH Root Password Brute Force (Hydra)

Let's try to find the password of the root user of the box using Hydra and the rockyou wordlist.

Command:

Output:

We found the password with our brute force attack and we can use it to login to the root user via SSH.

Command:

Output:

And thus we have root.

And finally, we can read the user and root flag:

PreviousDjinn Write-UpNextHommie Write-Up

Last updated