search

Chemistry

Season 6 Machine

Nmap scan shows port 22 and port 5000 is open:

┌──(kali㉿DESKTOP-2TPMHIH)-[~]
└─$ nmap -Pn -sV 10.129.160.217 -p- --min-rate 1000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-19 22:55 CEST
Warning: 10.129.160.217 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.160.217
Host is up (0.030s latency).
Not shown: 65274 closed tcp ports (conn-refused), 259 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
5000/tcp open  upnp?

If we browse to the IP on port 5000 we find a web tool called 'Chemistry CIF Analyzer' which has a Login and Register page.

I'll try creating a user called 'test' with password 'password' and we're presented with a dashboard with the possibility of downloading an example CIF file

I found thisarrow-up-right vulnerability after searching for a while and after fiddling around with the payload and the example CIF file I eventually got it working and below you can see the malicious CIF file.

If you upload this and 'View' the file while listening on port 4444 you'll get a reverse shell.

Looking around the file system we can see the user flag is in /home/rosa/user.txt but we don't have permission to read that as the 'app' user. Instead let's look through the source code for the app and see if we can find anything useful.

While looking at the code we see that it's a flask app that uses a sqlite database.

Grabbing the MD5 hash for rosa and checking that on CrackStationarrow-up-right reveals the password to us and we can now SSH as rosa with her password and grab the user flag. ✅

PreviousCicadaNextPlanning

Last updated