HA Joker CTF

HA Joker CTF

Summary(Mentioned by creator):

1. Enumerate Services
   - Nmap
   
2. Bruteforce
   - Performing Bruteforce on files over http
   - Performing Bruteforce on Basic Authentication
3. Hash Crack
   - Performing Bruteforce on hash to crack zip file
   - Performing Bruteforce on hash to crack mysql user
   
4. Exploitation
   - Getting a reverse connection
   - Spawning a TTY Shell
5. Privilege Escalation
   - Get root taking advantage of flaws in LXD

Rating: Medium

Walkthrough:

1. Enumeration:

Starting with nmap scan

So we can see port 80 and 8080 have http open but 8080 requires authentication

Alright here you go with webpage let's try out dirbuster

So we got phpinfo.php we can checkout which php version it is using.

we landed on one more file which seems a bit interesting

As we can see the potential username can be joker.

So let's move on brute force I will use hydra to get password for 8080 port.

With that you can now see another webpage.

Now here we can see joker used joomla cms let's try login with same password.

Nope...

Let's run nikto here with user and password

Here we can see archive and admin portal let's check archive for creds

with same passwords as of http we can unzip it.

Now we have superduper user

Let's login and get shell in joomla

From here let's change the template with php reverse shell

I used pwncat and got shell as we can see www-data is part of lxd we can privesc using lxd containers

I recommend https://www.hackingarticles.in/lxd-privilege-escalation/

check out this blog for getting better understanding of privesc using lxd