# TryHackme Simple CTF room Walkthrough

Hi! I'm Adbin Magar, the researcher behind **TheGreyLens**. If you’ve seen my previous blogs, you know I’m currently tackling CTF challenge where I complete TryHackMe rooms and document the process. Today I will be walking you through the **Simple CTF** room.

#### **🛠 Tools Used**

*   **Nmap**: Network scanning and service enumeration.
    
*   **Gobuster**: Directory brute-forcing.
    
*   **Exploit-DB**: Identifying CVEs.
    
*   **Hydra**: SSH credential brute-forcing.
    
*   **GTFOBins**: Privilege escalation techniques.
    

**Question 1:** How many services are running under port 1000?

I used my go-to tool **Nmap** to scan the target. It revealed three open services. Excluding the high-port service (2222), there are two services running under port 1000.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/8ce80b32-8c92-4638-86c4-809f054bc532.png align="center")

**Answer: 2**

**Question 2:** What is running on the higher port?

**Answer: ssh**

**Question 3:** What's the CVE you're using against the application?

I used **Gobuster** and discovered a `/simple` directory.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/1c88fae7-023a-4cd0-b988-92b38496ab42.png align="center")

After discovering `/simple` directory. I open it in my my browser and scrolling to it revealed that the site was running **CMS Made Simple version 2.2.8**.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/c8556592-1230-413a-8cef-8ac521430697.png align="center")

After searching the Exploit Database, I found an exploit applicable to all versions lower than 2.2.10 of CMS Made Simple.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/14f1e7e8-ceb4-4456-b6bf-ce9db14cdef8.png align="center")

**Answer: CVE-2019-9053**

**Question 4:** To what kind of vulnerability is the application vulnerable?

looking it more I discovered example url to get the administration console which i decide to try it :

`http://.../simple/admin`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/00b23ef6-39e4-4cec-8f56-2b0d5f7a37e6.png align="center")

It show me admin panel which confirmed that the admin panel was accessible and it is in default url.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/6e7b49e3-de40-4a9f-9c32-41e6e6995968.png align="center")

![]( align="center")

After researching the CVE I identified, I found it is vulnerable to a time-based SQL injection.

**Answer: sqli**

**Question 5:** What's the password?

Copy and paste the python code that we found on exploit db on our attacker machine as `.py` file for example [`exploit.py`](http://exploit.py) which i did here.

Also, for note we can get many errors while running the code. *Put parathesis/brackets for every line of code starting with print. For example,* `print ("[+] Specify an url target")`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/d3c179e1-5284-4ebc-a604-ca7414a6fe62.png align="center")

I ran the script with:

`python3 exploit.py -u http://10.48.156.226/simple/`

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/ad71bb67-8992-4300-a3ed-c33e5b109cfc.png align="center")

This revealed the username `mitch` and passwords in hash format. But for now the username I got is very important. Using **Hydra** with `rockyou.txt`, I successfully brute-forced the `mitch` password.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/710a2c62-cfe8-425d-b90e-cce1e4024f40.png align="center")

**Answer: secret**

**Question 6:** Where can you login with the details obtained?

**Answer: ssh**

**Question 7:** What's the user flag?

I test in browser username as `mitch` and password as `secret` to see if it will logged me in or not which it did.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/e09e54eb-d757-4031-9554-1f5e5cda003f.png align="center")

Then i login as mitch through SSH service. When doing just `ls` command it show me `user.txt`. When reading the file it was the flag.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/5c842728-a4e4-40d3-ae9e-dbbd3a3dfab4.png align="center")

**Answer: G00d j0b, keep up!**

**Question 8:** Is there any other user in the home directory? What's its name?

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/43ab9b83-0ac4-4124-96e7-c06eaf0e251f.png align="center")

**Secret: sunbath**

**Question 9:** What can you leverage to spawn a privileged shell?

During privilege escalation, I used `sudo -l` to check my permissions. It showed that `mitch` can run `/usr/bin/vim` without a password. Referencing **GTFOBins**, I found that `vim` can be used to spawn a root shell.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/de35c5b7-a826-4a72-98cf-fdc873e95701.png align="center")

**Answer: vim**

**Question 10:** What's the root flag?

Using the command `sudo vim -c ':!/bin/bash'` (found on GTFOBins), I spawned a root shell. I then used `find` command to locate the `root.txt` file which give me instantly where it was which in the `/root` directory. The using `cat` command I read the root flag easily.

![](https://cdn.hashnode.com/uploads/covers/6914271866fe9f4d18f8b8c2/b64503ff-c263-42db-b75b-b61cd73ba17d.png align="center")

**Answer: W3ll d0n3. You made it!**

### **🎯 Day 4 Mission Accomplished**

Flag captured! That concludes Simple CTF room of my CTF challenge. Today was also a great learning experience. I hope you learned something too. See you on next blog.

Happy hacking! :)