Born2Root 2 CTF

This time I decided to check CTF prepared by Hadi Mene called "Born2Root". Let's find out how to solve it...

We should start here:

Cool, let's find some open ports:

 So:

Ok, checking HTTP:

I tried to check all found resources, one by one:

Next I found Joomla:

I was wondering if I should perform some bruteforce attack here or it will be a bug in some plugin/old version... Checking:

So far, so good. We have a version number. More:

And see... The password is already there xD

Checking:

Next step: go to admin's panel and try to upload a webshell:

(If you want, you can try to modify joomlash.py to check it here ;))

Next:

Let's verify:

Ok, looking around:

I decided to get reverse shell (I used the one from PentestMonkey resources):

Now we are here:

I was looking for some SUID files (like last time ;]):

Nope. So next during OS enum I found Joomla config file with password and new username to check:

So I tried to find more passwords in DB:

 ... and I found that one exploit from Metasploit (see 'expl0iter' ;)) - worked ;] but it was to late for it.

Next I found file called fileshare.py:
 

So I tried hardcoded password:

Yep. Next thing: checking for sudo:
 

Great, it should be fast:

And... 

That was nice CTF. Big thanks goes to Hadi Meme for preparing this game.
Also big thanks goes to the VulnHub Team for sharing all of those CTFs.

See you next time!

Cheers