Simple CTF
1. Enumeration — Nmap
A full port scan reveals three open services. Note that SSH is on the non-standard port 2222 — a detail that matters later.
| Port | Service | Relevance |
|---|---|---|
| 21 | FTP | Anonymous access / file leads |
| 80 | HTTP | Web app — primary attack surface |
| 2222 | SSH | Non-standard port for later login |
2. Web Discovery — Gobuster
Directory brute-forcing the web root uncovers a hidden application path.
Browsing to /simple/ reveals the application and, critically, its version in the footer: CMS Made Simple version 2.2.8. Version disclosure is the pivot for CVE research.
3. Exploitation — CVE-2019-9053
CMS Made Simple versions below 2.2.10 are vulnerable to CVE-2019-9053, a time-based blind SQL injection in the News module. Exploit-DB script 46635.py automates extraction of the username, password hash, and salt, then cracks the hash against a wordlist.
Credentials recovered: redacted / redacted.
4. Foothold — SSH on Port 2222
The recovered credentials are reused for SSH — remembering the non-standard port from the Nmap scan.
5. Privilege Escalation — vim sudo Escape
Checking sudo rights shows redacted can run vim as root with no password. Per GTFOBins, vim can spawn an interactive shell — and when launched under sudo, that shell runs as root.
Key Takeaways
CVE-2019-9053 is a time-based blind SQLi — no output returned, but boolean logic reveals the database character by character. Once credentials are extracted, the sudo misconfiguration is a textbook GTFOBins privilege escalation.
Patch promptly — CMS Made Simple 2.2.10 fixed this. Audit sudo permissions regularly. vim and other editors should never have NOPASSWD sudo access. Run web applications as a non-root user.