sudo vim Was All It Took to Go From User to Root — Simple CTF (TryHackMe)

Attention-grabbing opening: In a straightforward Capture The Flag challenge, a single command, sudo vim, elevated a user to root status across three services on an anonymous FTP server. This simple CMS-based attempt illustrates the vulnerabilities present in web applications.

Initial reconnaissance: Three distinct ports were identified via Nmap - FTP, HTTP, and SSH. The anonymous FTP login allowed immediate access to the system, while the SSH service operating on port 2222 appeared to be a security measure rather than an added layer of protection. The robots.txt file on the HTTP server revealed a medical records software installation at /simple/, which proved to be a red herring.

Exploiting the CMS: After discovering the true target CMS at /simple/ during directory enumeration, attackers uploaded a PHP reverse shell. The CMS Made Simple version was outdated, and contained a blind SQL injection vulnerability in the News module, which allowed attackers to extract usernames, email addresses, password hashes, and salts directly from the CMS database. Using this information, the hash was cracked using Hashcat mode 20 with a rockyou.txt dictionary attack, revealing the password "secret".

Access and exploitation: With the cracked credentials, the attackers gained access to the CMS admin panel, logging in successfully with mitch:secret. After confirming the credentials using Hydra brute-force tool, the CMS admin panel was used to upload a PHP reverse shell. Although the application attempted to prevent malicious file uploads, it failed to account for alternative PHP execution extensions like .phtml, allowing the reverse shell to be uploaded successfully.

Finally, by navigating to the uploaded file, the shell was triggered, granting the attackers complete control over the system.