This entire solution has been written by :
<aside> <img src="/icons/promoted_pink.svg" alt="/icons/promoted_pink.svg" width="40px" />
</aside>
(TryHackMe Profile: https://tryhackme.com/p/soumyabratamukherjee64). It would have been not possible if not helped by my friends in Discord (discord.gg/tryhackme).
Name of challenge: Publisher
Description: Test your enumeration skills on this boot-to-root machine.
Task 1 Overview :
The "Publisher" CTF machine is a simulated environment hosting some services. Through a series of enumeration techniques, including directory fuzzing and version identification, a vulnerability is discovered, allowing for Remote Code Execution (RCE). Attempts to escalate privileges using a custom binary are hindered by restricted access to critical system files and directories, necessitating a deeper exploration into the system's security profile to ultimately exploit a loophole that enables the execution of an unconfined bash shell and achieve privilege escalation.
First we have to visit MACHINE-IP:80 to view the webpage.
I was focused on some words from this challenge: One being directory fuzzing and other being version identification. We took help of AI, especially ChatGPT and Claude to assist us.
We run a nmap scan but don’t get anything.
So we run a rustscan AS FOLLOWS:
rustscan -a <IP>
Our rustscan output showed us two ports being open at same time: one is the SSH(22 PORT) and the HTTP (80 PORT).
As we didn’t get it anything over the HTTP Port, we run a ffuf scan as said by directory scanning:
ffuf -a http:<IP>:80/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 64