Saihat's Network Security Blog

Introduction Today we're doing a CTF writeup for the Internal challenge from the NahamCon2021 CTF. Internal is a Linux PrivEsc challenge, and after we start the challenge we received a string we can use to interact with the challenge: The first thing we do is log in to the system as the orion user using captured SSH credentials we obtained from a a previous challenge: ssh -p 30718 orion@challenge.nahamcon.com input password: stars4love4life While enumerating running processes, we find some interesting stuff: ps -aux The root user is running MySQL as well as a Bash script that references MySQL . Let's take a look at that Bash script: cat /create_mysql_admin_user.sh The information in the script indicates that the root account in MySQL is setup without a password. Let's login to MySQL as root now: mysql -uroot -p input a blank password Using MySQL as the root user, we can read any files in the system that we are aware of. Because the common location of the flag.tx...