Wgel CTF - Easy

• ffuf scan: ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.10.213.126/FUZZ

• This gives us a directory named /sitemap

• We can use ffuf on the sitemap website as well. This will give us directories like /css, /js, /fonts amd /.ssh

• Furthermore, the default page for http://10.10.213.126, a Apache2 page, contains the following comment:

<!-- Jessie don't forget to udate the webiste -->

• The /.ssh directory contains a id_rsa file (private key)

• We can also go for SSH username enumeration with the help of Metasploit. The module that we would be using is auxiliary/scanner/ssh/ssh_enumusers

• This gives us a list of users we can check. We can use 'jessie' as an user as well, assuming from the previous clue in comments.

• We save the RSA private key found in a id_rsa file in our directory and SSH the machine to check if jessie can login using that password.

chmod 600 id_rsa

ssh jessie@10.10.213.126 -i id_rsa

• The SSH login worked and we are logged in as Jessie

• User flag: 057c67131c3d5e42dd5cd3075b198ff6

• Now we have to find a way to escalate our privileges

• sudo -l shows us that we can run /usr/bin/wget as root

• By checking exploits available for wget on GTFObins, we can use a file read command to get the root flag.

LFILE=/root/root_flag.txt

sudo wget -i $LFILE

• This gives us the root flag: b1b968b37519ad1daa6408188649263d