privilege escalation – Page 3 – Bootlesshacker's Cybersecurity Blog

This is my second CTF exercise that I have developed. It is rated as ‘Hard’.

Synopsis:

Cyber criminals have taken over the energy grid across Europe. As a member of the security service, you’re tasked with breaking into their server, gaining root access, and preventing them from launching their malware before it’s too late.

We know from previous intelligence that this group sometimes use weak passwords. We recommend you look at this attack vector first – make sure you configure your tools properly. We do not have time to waste.

Unfortunately, the criminals have started a 3 hour clock. Can you get to their server in time before their malware is deployed and they destroy the evidence on their server?

The types of vulnerability/techniques used in this CTF can be seen below (they are intentionally hidden by default):

Brute force
Pivoting
Network enumeration
Remote Code Execution
Privilege Escalation
GPG Decryption

This exercise is designed to be completed in one sitting. Shutting down the virtual machine will not pause the timer. After the timer has finished, the CTF machine will be shut down and you will be unable to boot it. Please keep a local backup of the CTF prior to starting, in case you wish to attempt a second time.

If you are to succeed, I strongly recommend reading these points:

Keep a local backup before starting in case you run out of time
You will need a basic understanding of the GPG tool and how it works
Configure your tools so they work at the maximum/hardest level possible. Make sure you are looping around the correct thing, if you know what I mean
Getting the initial shell is possibly the longest part.
There are four flags in total. Each flag file will guide you to the next area

This virtual machine has been tested in VirtualBox only. I cannot guarantee it will work on VMWare, but it should be okay.

You can download the CTF here. I look forward to your feedback.

SHA-256: 8bc79937082748c21de14c5da3772f7fc750d52b68cf27816922186f6e68d6b7

Version Number	Description of Changes	Date of Change
1.0	Initial release	20/05/2020
1.1	Stability release – changed some network settings to make this work correctly in non-VirtualBox setups	26/05/2020

Credit Card Scammers CTF

This is my first Capture the Flag exercise and covers a number of different techniques.

Download Now

The back story: Scammers are taking advantage of people and various fake shopping websites have been setup, but people are finding their orders never arrive. We have identified one scam website which we believe is harvesting credit card details from victims. Your objective is to take down the scam website by gaining root access, and identify the 3 flags on their server. Our intelligence suggests the scammers are actively reviewing all orders to quickly make use of the credit card information.

The types of vulnerability used in this CTF can be seen below (they are intentionally hidden by default):

- XSS
- SQL
- Privilege escalation
- Hash cracking or brute forcing

You can download the Capture the Flag here. This has been tested using VirtualBox but may work with other virtualisation platforms. DHCP is enabled, and it is recommended you run this in host-only network mode.

Please feel free to leave me feedback in the comments. I am keen to see what people thought about it and how easy/difficult they thought it was.

SHA-256: e840abca18c81bb269a02247a99416b0f63261f3a62d4b17b9436fb3387f70e7