How to hack: Midnight CTF — vulnhub walkthrough

We start by downloading the VM from https://www.vulnhub.com/entry/sunset-midnight,517/, add it to VirtualBox and adjust the network settings.

We then fire up netdiscover to locate the VM’s IP address:

netdiscover -i eth1 -r 192.168.0.0/24

Following the instructions for the VM we add a hosts entry with that IP:

Then we do a nmap run to see any ports open:

It’s not common that MySQL is open, so we will take on that one first

Port 80 has the usual WordPress site:

SimplyPoll seems to have a mysql injection exploit

Let’s give MySQL a run while we do any other checks:

Well… this works also …

Since we’re root in MySQL we move around freely:

WordPress has only one user:

We can use this guide to create ourselves an admin user:

How to Add an Admin User to the WordPress Database via MySQL

Queries are at the bottom of the page on the link

We now log in to WordPress using demo/demo, and we have full access to the blog:

Now we get access to the disk by installing the “Advanced File Manager” plugin:

Awesome plug-in, even for regular WP use …

I now download my trusty workhorse (or pony): p0wny shell from https://github.com/flozz/p0wny-shell/blob/master/shell.php

and upload it at the site’s root:

Then browse to it:

we have a user called jose and his flag, but no permissions for it:

After a long while of searching for stuff I notice that WordPress is running with the MySQL user of jose:

And his DB password is the same as SSH:

Flag acquired!

Now that I am logged in as jose, I run LinEnum.sh (https://github.com/rebootuser/LinEnum)

Looking at the SUID/SGID files, I notice one that has a recent modification date compared to the rest of the system: “/usr/bin/status”

If I run it, it says that service is not found:

It’s calling the service command

Running it with www-data does work:

This is just a “service ssh status”

I create a fake “service” file, that will just tell me who is running it and rerun the status command:

Also added the home folder to the $PATH so it can find it

I’ll setup a netcat listener and add my python reverse shell script to the fake service command:

And there’s the flag:

nice sunset …

This is the source code for the status command:

Hope you enjoyed this guide :)