CTFs | CTF_INSA_2024 | Web | MegaUpload

MegaUpload

1 - Bypass upload filter

For this challenge, we have a website where we can upload files. But the upload is limited to image files (.jpg) and text files (.txt), other files return an error:

Each uploaded files are in /uploads/ directory. We can see that if we run a Gobuster on the website.

We need to bypass the filter extension, for that, we can try to upload a .htaccess file with a new rule read by the web server.

This rule allows web server to run PHP code inside .jpg files.

Here is a blog talking more in detail about bypass filter upload.

And it works!

With this rule, we can now upload and execute arbitrary PHP code inside .jpg files and, with this script, get a reverse shell:

2 - Become another user

First we get a shell and beautify it:

We can read the /etc/passwd to check all existant user.

There is a user named debian, so we go see what it has in his home directory and find a readable ssh private key:

We try to connect with the ssh key to debian user but ssh asks for a password:

This means the key is encrypted, so we have to find the key password. For that, we download the key on our kali and use ssh2john to extract the hash in a john format. And now we can use john to crack the hash using the rockyou word list.

Fine, we can connect to debian user:

3 - Become root

We try sudo -l to see which command can execute debian:

debian can execute tar with no password as any user (ex: root), we search on gtfobin the tar command that can gives us a root shell:

We execute the given tar command and as you can see, we get a root shell:

And the flag is inside the /root directory.