THM: Boiler CTF

After logging in the ftp server as anonymous, I only had to run ls -a, (since plain ls did not list any files and pwd told me that I’m in /), to see a hidden file, which I then moved to my machine and checked out:

Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl!

It is encrypted, but not in any formats I have gotten used to, but I figured it would not be very difficult to find (it seemed like a 1to1 map). It was actually the first technique I tried: ROT13

Just wanted to see if you find it. Lol. Remember: Enumeration is the key!

With that said, after also checking for exploits in the FTP server’s version, I do not think that there is anything else here.

I am getting pretty comfortable checking webpages out, so I was disappointed seeing just the default Apache2 Homepage.

However, seeing that there were disallowed entries in robots.txt (http-robots.txt was executed among the default scripts by nmap), I figured that I should check it out. There were a lot of entries there¹, but after visiting them, they were not of any interest (the files/directories did not exist).

There was, a little bit encoded string following, that I had to check.

079 084 108 105 077 068 089 050 077 071 078 107 079 084 086 104 090 071 086 104 077 122 073 051 089 122 085 048 077 084 103 121 089 109 070 104 078 084 069 049 079 068 081 075

Seeing that everything consisted of 3 digits, all of which lower than 122, I thought that it may be a weird way to depict a string, using its ascii characters:

def convert_to_ascii(input_string):
    integers = input_string.split()
    ascii_chars = [chr(int(num)) for num in integers]
    return ''.join(ascii_chars)

input_string = input("Enter space-separated integers: ")
result = convert_to_ascii(input_string)
print("ASCII representation:", result)

The output was just barely more promising than what we started with, and hash-id does not give me reason to believe its a hash (of any kind)

OTliMDY2MGNkOTVhZGVhMzI3YzU0MTgyYmFhNTE1ODQK

(It was actually not used at all)

I, then, ran

gobuster dir -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://boiler.thm -o gobuster.big

giving me a couple of new directories AND, which is more an actual website!

in the meantime, the full nmap scan was complete, and after using nc to connect to that port (55007), an ssh server also became available :P.

The question “Can you exploit the service running on that port?” got me thinking that I should most probably go there, before keep going against the joomla website, but I was wrong. A quick search revealed that there was no readily available exploit on the running version, so the answer there, sadly, was “nay”

Getting back to the website, I ran another gobuster instance, this time aimed at enumerating the joomla subdir:

gobuster dir -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://boiler.thm/joomla -o gobuster-joomla.big

There were a lot of entries as well:

• The ones starting with _ got my attention, and after getting to _test, I thought I am getting somewhere

There are 3 actual users:

• root
• stoner
• basterd (which troubles me, since there is no login shell in their /etc/password entry)