Recent content on
Introduction This weekend I had some fun participating in the P3RF3CTR00T CTF 2024 by p3rf3ctr00t ctf team. This is my second writeup, I’ll cover the forensics category specifically how I solved the Streams and Secrets set. I am not really that into forensics but I had to give it a try to score some points, I also got first blood on some of them. I was going solo in this CTF under…
Introduction This weekend I had some fun participating in the P3RF3CTR00T CTF 2024 by p3rf3ctr00t ctf team, barely got some sleep. They really did a good job considering it’s their first edition of the CTF, I didn’t experience any downtime and support was very helpful on their discord server. They had over 50 challenges! Kudos to them, I am happy to see an evolution of CTFs in the…
Introduction Following my previous writeup that I did for Misc challenges in the NahamCon CTF, I decided to play the challenges in the Mobile category. This is post CTF as they left the challenges up for a few days after the competition was over. I tried my best to not look at released writeups as I worked on these challenges as a way to learn something new or even just practice some of what I…
Introduction NahamCon 2024 is taking place this weekend and they had a CTF as part of the online conference. I participated with team fr334aks . We managed position 197. We did good on Web, Mobile and WarmUps but not well on other categories like Binary Exploitation and Crypto. It was our first CTF of the year together, so it’s not a bad start from a long break. Hopefully we get back to our…
Introduction After a long while since I participated in a CTF, I had the pleasure to participate in HTB Business CTF 2024 these past few days. I enjoyed myself despite having only solved a handful of challenges. I went solo and didn’t rank quite high but I’m still pleased with myself. In this post, I’ll cover the challenges I solved under the FullPwn category which is similar to…
Introduction In this post, I’ll be covering solutions to the Misc Challenges from the HTB Business CTF 2024 . 1. Hidden Path This challenge was rated Easy. We are provided with files to download, allowing us to read the app’s source code. On reading the code, we see that the app accepts user input on the /server_status endpoint. It takes in choice parameter and something else.…
Introduction After passing my OSCP, I am planning on doing CRTP and CRTO sometime this year. I took the OSCP exam before the updates that are focused on Active Directory so I didn’t actively focus on this area. So to learn and practice on AD and Windows and also as some prep for the certifications I plan on taking, I will be doing some machines that are AD related and try to get into the…
Introduction Similar to last year’s ctf we are provided with a kali machine as the jump box and an Ubuntu VM with ports open for the different challenges. As usual I participated with team @fr334aks and we were able to solve 8 challenges and got position 47/265. This year most of the challenges were tougher than last year as we solved less. It was a good experience nonetheless. You can read…
Introduction @SheHacksKE held their yearly hackfest event in October 2021 but it was online this year. The event included a CTF that was facilitated by @eKRAALhub . @mystic_kev and I participated in the CTF as NoPwnNoGain and won it by completed all challenges. This writeup is for the challenges I was able to solve. Challenges: Firmware 1. Camera Kernel The provided file when extracted contains a…
Introduction Last week @mystic_kev and I participated in the AfricaHackon 2021 CTF finals as team NoPwnNoGain, we managed position 4. We were able to solve 3 challenges with first blood on 2 of them. This writeup demonstrates how I was able to solve one of them. Challenges 1. Processing Challenge description: For this challenge we are provided a zip file with the java apps for the challenge. The…
Introduction H@cktivityCon 2021 was happening over the weekend and I participated in their ctf with team @fr334aks . We managed position 49 out of 2527 teams. This writeup is of the challenges I managed to solve. Challenges 1. Mobile: To Do Challenge Description: We are provided with an apk file. First thing I typically do with apk files is open them with jadx-gui. jadx-gui todo.apk Here I first…
Introduction Package managers are run with root permissions on linux distributions to install, update or remove software/packages. In certain cases the user should not be a root/admin user but has been assigned sudo permissions to run the package manager only for package management purposes. We’ll look at how this permission can be abused to gain root access to the machine via a root shell.…
Introduction Netcat is a tool that reads and writes data across network connections, using TCP or UDP protocol. Netcat has been referred to as the TCP/IP / networking swiss army knife. In this article we’ll look at different applications of netcat and how it can be useful in day to day activities of a pentester, security professional, sysadmin etc… If you would like to test out these…
Difficulty Release Date Author Beginner 15 Feb 2020 Love Summary In this box there’s only one port open that is running a vulnerable version of sar2html that we take advantage of to get a low priv shell. For privilege escalation there was a cron job running as root that was running a script we could write in. Reconnaissance Nmap Nmap scan report for 192.168.56.107 Host is up (0.000040s…
Difficulty Release Date Author Beginner 24 Sep 2019 FalconSpy Summary For this box, initial access was a web shell discovered. Then with low priv shell we could run bash as brexit user and were able to pivot to that account. Once we are brexit user, we abuse his membership to the lxd to start a privileged container that can read and write the whole file system by mounting it in the container.
Difficulty Release Date Author Beginner 26 Apr 2020 James Hay Summary For this box we only get one port running a web server and we discover wordpress and phpmyadmin by directory bruteforcing. On the wordpress application we bruteforce credentials of the users discovered and then discover more credentials stored in a draft post. With this new credentials we access phpmyadmin and write to a file…
Difficulty Release Date Author Intermediate 29 Jul 2020 v1n1v131r4 Summary For this box, we perform directory bruteforce on the webserver to discover a vulnerable version of openemr. Openemr here is vulnerable to sql injection that we leverage to extract usernames and password hashes. After cracking the hashes, we use the discovered credentials to access the ftp server and upload a php reverse…
Difficulty Release Date Author Beginner 2 Nov 2019 Ic0de Summary This was an easy box, initial foothold was on wordpress. You needed to bruteforce the admin creds then get a reverse shell via editing a theme file to get the reverse shell. Escalating to root was straightforward as we found the root password in a txt file. Some kernel exploits could have also been used for privilege escalation.…
Difficulty Release Date Author Beginner 2 Mar 2020 Zayotic Summary In this box, we first perform ldap injection on the web application to bypass the login page. Then we are able to read local files by abusing a local file inclusion vulnerability with php base64 filter. From one of the php files we get ldap credentials that we used to authenticate to ldap and dump entries. From the entries we get a…
Difficulty Release Date Author Intermediate 20 Aug 2019 Zayotic Summary For this box, some directory bruteforce is needed to discover some php files. One of the php files has an lfi vulnerability but can only be access by authenticating to the other page. The login form can be bypassed and we exploit the lfi. For that we poison ssh logs for exploitation to rce. For privilege escalation we exploit…
Difficulty Release Date Author Intermediate 7 Apr 2020 Zayotic Summary In this box, we need to perform some directory bruteforce then use shellshock vulnerability to get our first shell. We then sniff local traffic using tcpdump and get credentials for the next user who has permissions to write python2.7 lib directory. Using those write permissions we hijack a library that is imported in a script…
Difficulty Release Date Author Intermediate 18 July 2019 Zayotic Summary This box had quite a good number of misconfigurations and vulnerabilities. Initial access was through copying a shadow backup file to a smb share accessible anonymously using a file copy vulnerability in proftpd. Then lateral movement and privilege escalation was achieved by exploiting rce a locally running librenms instance…
Difficulty Release Date Author Beginner 29 June 2019 Zayotic Summary I got an OSCP voucher last year and this is my active effort to prep for it using TJ-Null’s OSCP Prep list. Hopefully documenting this will help improve my methodology and get me ready for OSCP and beyond. In this box, initial access is through lfi to rce by using sending a payload in mail and accessing it.For privilege…
Summary Over the weekend I participated in Metasploit Community December CTF by Rapid7 with team fr334aks . We ended up getting position 57/413. The CTF was meant to be beginner-friendly. Intro Teams are provided with their own instance of a kali box which is public facing to act as a jump host to reach an ubuntu VM which hosts the challenges. On the ubuntu VM there are 20 open ports for each…
Summary During Grayhat Conference the Red Team Village hosted a beginner/intermediate CTF. Our CTF team fr334aks decided to participate as we enjoyed the previous CTF created by them during DEFCON. I tackled the Tunneler challenges that were exactly the same as the previous CTF. So with the less pressure it was a nice opportunity to make a writeup for ssh tunneling techniques. I am writing this to…
Summary I recently participated in RaziCTF 2020 with team fr344aks and I was able to solve an android challenge that I thought needs a proper writeup. I was able to reverse engineer the provided app and use frida for dynamic analysis for a quick win. Challenge Description: I first installed the app in my genymotion emulator to see the basic functionality. There is a padlock icon constantly…
I recently worked on a CTF challenge by CyberSpace Kenya which I ended up winning. This is a writeup on how I solved the challenge. We were provided with an android app to reverse engineer and submit 3 flags. Flag 3 I haven’t done tons of mobile app reverse engineering but as I was learning about the subject in previous challenges I found this 2-step approach to work well: Extracting the apk…
Summary As the name suggests this box had a instance of gitlab where the initial foothold involves getting credentials from obfuscated javascript and once logged into the gitlab instance we abuse webhooks to add our own code and execute it to get a reverse shell. Read on to see how I able to root the box. Enumeration As usual I start with a quick nmap scan to find open ports and then run a second…
Summary Bastion was a relatively easy box. There is an smb share is accessible without credentials and inside there is a backup drive that we can mount and access. From the drive we can dump the SAM file and crack it to get login credentials. Once logged in we find mRemoteNG installed and extract its saved passwords to get admin access. Enumeration I start with this nmap command to quickly find…
My name is Michael Ikua, I am a CyberSecurity Professional from Kenya 🇰🇪. My main focus is on Offensive Security (Penetration Testing and Red Team Operations). I am also an Active CTF player and a Passive Bug Hunter. Links: Twitter / X LinkedIn Github CTFtime HackTheBox Medium Hackerone Pentesterlab Certifications: Support My Blog:
2024 P3RF3CT R00T CTF 2024 Writeup - Forensics P3RF3CT R00T CTF 2024 Writeup - Active Directory NahamCon CTF 2024 WriteUp - Mobile NahamCon CTF 2024 WriteUp - Misc HTB Business CTF 2024 WriteUp - FullPwn 2022 Hack The Box: Forest 100 Days of Hacking - Shells [Video] 100 Days of Hacking - Shells [Slides] 2021 Metasploit Community CTF 2021 WriteUp SheHacksKE HackFest 2021 CTF WriteUp AfricaHackon…