{"id":23524275,"url":"https://github.com/rickidevs/millisec-ctf","last_synced_at":"2025-05-14T06:16:19.426Z","repository":{"id":269353723,"uuid":"907147784","full_name":"Rickidevs/Millisec-CTF","owner":"Rickidevs","description":"writeup","archived":false,"fork":false,"pushed_at":"2024-12-22T23:54:13.000Z","size":0,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-12-23T00:35:52.783Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Rickidevs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-22T23:53:12.000Z","updated_at":"2024-12-22T23:54:17.000Z","dependencies_parsed_at":"2024-12-23T00:35:54.645Z","dependency_job_id":"2494c618-d0e7-4842-afb1-12fd4fd8f21d","html_url":"https://github.com/Rickidevs/Millisec-CTF","commit_stats":null,"previous_names":["rickidevs/millisec-ctf"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rickidevs%2FMillisec-CTF","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rickidevs%2FMillisec-CTF/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rickidevs%2FMillisec-CTF/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Rickidevs%2FMillisec-CTF/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Rickidevs","download_url":"https://codeload.github.com/Rickidevs/Millisec-CTF/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239217102,"owners_count":19601593,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-25T18:15:23.598Z","updated_at":"2025-02-17T00:51:46.596Z","avatar_url":"https://github.com/Rickidevs.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"Hi, this is a write up for an interesting room from TryHackMe called ‘Millisec’.\n\n**Exploitation**\nFirst, we will start by scanning the given IP.We can see that 3 ports are open.\n\n\nNow, let’s scan these ports more deeply.\n\n\nAnd we see that anonymous access is enabled on the FTP port on port 21.\n\n\nI accessed the admin panel and searched for ways to get in, but I couldn’t succeed. Maybe this is a rabbit hole.\n\n\nI returned to the homepage and tried to register, then I noticed that the user ID is visible in the URL, and I tried to change it.\n\n\nI set the ID value to 0, and an image appeared in front of me.\n\n\nLet’s take a look at the metadata of the image.\n\n\nI went to the directory found from the metadata, and there is a page used to execute commands there.\n\n\nMaybe there is a command injection vulnerability here. To check this, I wrote a command that could bring me a reverse shell.\n\n\n\n**Privilege Escalation**\nFirst, I ran the sudo -l command on the system and saw that I could run the /home/millisec/simba file as the millisec user without a password. Then, I used cp /bin/bash /home/millisec/simba to copy the /bin/bash shell to the simba file. After that, I ran /home/millisec/simba as the millisec user with the command sudo -u millisec /home/millisec/simba.\n\n\nAfter switching to the millisec user, I ran the sudo -l command and saw that I could run /usr/bin/perl /root/*.pl as the root user. Then, I executed the following commands:touch perl.pl \u0026\u0026 echo 'print do { local $/; open my $f, \"\u003c\", \"/root/root.txt\" or die; \u003c$f\u003e };' \u003e perl.pl \u0026\u0026 chmod +x perl.pl\n\nThis created a file named perl.pl, which was designed to read the contents of the root.txt file. I then gave execution permissions to this file. Finally, I ran the following command:sudo -u root /usr/bin/perl /root/../home/millisec/perl.pl\n\nThis allowed me to successfully read the contents of the root.txt file.\n\nUpon analyzing the last command, we can observe that the file path needs to start with /root and end with .pl. However, by adding .., we managed to execute the file we created under the millisec user's home directory as the root user.\n\n\nI hope you had fun solving this CTF!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frickidevs%2Fmillisec-ctf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frickidevs%2Fmillisec-ctf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frickidevs%2Fmillisec-ctf/lists"}