Wgel CTF

M4$T3R_M!N&

4 min readJan 7, 2024

{Try Hack Me}

Q1. User.txt

Ans:1

So let’s start our machine….. Don’t forget to start your vpn okk..
Scanning:

Ok.. we have some ports available

PORTS

http port 80 and port 22 for shh

try to have a look on port 80, the web page

Nothing much a default page for Ubuntu, so now we have to crawl into the site for further directories.

Always try to have a look on the source page, there might exists something that can help for our further process.

So after looking i found something….. it is basically a name “Jessie”.

note this name for our process.

Tool: gobuster or dirbuster (dirb)

command: gobuster dir -u <url> -w <wordlist path>
command: dirb <url> <path for the worlist>

So in our case I am gonna use common.txt as the wordlist

There it is we found a page for sitemap. Visit the page and try to find something.

i found nothing here so i used the same tool to crawl into the site maybe there is a chance to have something.

then i found a page inside /sitmap/.ssh

let’s have a look onto it.

oooooooooooooooo…………………..

There it is a rsa file. Download this file.

Get M4$T3R_M!N&’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You can do it by writing a simple command

command: wget <paste the link>

ok now we have an important thing with this we can login with ssh, for that write the command

for this we need to give the permission to the file so

command: chmod +x <file name> or chmod 600 <file name>

chmod 600 : a file permission setting in Linux where read and write permission is granted to the owner, and no permission is granted to the group and user

command: ssh -i <file key> <username>@<ip>

for our case we have jessie as a name but we don’t that is it a user or not. So at this moment, i am trying a trial and error part.

ssh -i <file name key> jessi@<ip>

use the basic commands for the same such as

and all for the First flag i.e user.txt

There it is

Q2. root.txt

Ans 2: The basic idea behind getting this flag is privilege escalation. So fo this we need to check who we are i.e root or a user

command: whoami

type the command for priv esc

command: sudo -l

OK, so we can run wget as root. It is likely that this binary is exploitable, to check this out I always head over to GFTObins, which is an excellent resource.

Get more information about this in: https://gtfobins.github.io/gtfobins/wget/

Start your netcat listner in your system, on some particular ports.