# walkthrough

An analysis of the four flags recovered from the ENPM685 Final Grade Server, a
single Ubuntu 22.04 VM (192.168.1.152) assessed as a solo black-box CTF in May
2025. Each flag is a different class of web or host vulnerability.

This is a summary. The full engagement, every command, with terminal output and
screenshots, is in [`../report.pdf`](../report.pdf).

## attack surface

| port | service |
| --- | --- |
| 22 | ssh |
| 80 | http, the grade-server web app |
| 10000 | webmin / web admin console |

An nmap SYN scan (`nmap -sS -p- 192.168.1.152`) surfaced these three services.
The web app on port 80 was the way in; port 10000 gave administrative command
execution; port 22 was the route to the final flag.

## the four flags

| flag | value | class | cwe | severity |
| --- | --- | --- | --- | --- |
| flag1 | "Let Me in" | sql-injection | [CWE-89](https://cwe.mitre.org/data/definitions/89.html) | critical |
| flag2 | "web app session? I like jam sessions better" | idor | [CWE-639](https://cwe.mitre.org/data/definitions/639.html) | high |
| flag4 | "There is no place like home" | broken auth + command exec | [CWE-1392](https://cwe.mitre.org/data/definitions/1392.html) | critical |
| flag3 | "Would I rather be feared or loved? Easy. Both." | privilege escalation | [CWE-522](https://cwe.mitre.org/data/definitions/522.html) | critical |

## flag 1, SQL injection in `addclasses.php?uid`

**critical, [CWE-89](https://cwe.mitre.org/data/definitions/89.html)**

*Where:* grade-server, `GET /addclasses.php?uid=<id>`

The `uid` parameter is concatenated straight into a SQL query. Appending a single
quote threw a database error, confirming the injection; sqlmap then enumerated a
second database, `look_in_here`, that the UI never links to. Its contents include
a cracked password, the flag.

```
sqlmap -u ".../addclasses.php?uid=1" --dbs found look_in_here; --dump
recovered the password `letmein` and the note "My cracked password is flag1".
```

**fix.** Use parameterised queries so the id is bound as data, never assembled
into SQL text. Add an allow-list on the parameter type (an integer id) and give
the database account read access to only the tables the app needs.

## flag 2, insecure direct object reference on the `uid` parameter

**high, [CWE-639](https://cwe.mitre.org/data/definitions/639.html)**

*Where:* grade-server, `GET /addclasses.php?uid=<id>`

The same `uid` parameter has no access control. Incrementing it walks through
every user's record; one of them (user `bingo`) carries the flag in its message.
`uid=1 OR 1=1` returns them all at once.

```
Browsing uid=1..6 revealed each user's message; uid=6 (bingo) held
"flag2: web app session? I like jam sessions better".
```

**fix.** Derive the record id from the authenticated session, not from a
client-supplied parameter, and authorise every object access server-side.

## flag 4, default credentials and command execution on the admin console

**critical, [CWE-1392](https://cwe.mitre.org/data/definitions/1392.html)**

*Where:* admin console (port 10000), HTTP Basic auth + command form

The web admin console accepts the default credentials `admin:password`, found by
a Hydra brute-force. Once inside, the "run a command" form executes arbitrary
shell commands. Listing the directory reveals `youshouldopenthis.txt`; reading it
is the flag.

```
Hydra recovered admin:password against the port-10000 login; the command form
ran `cat youshouldopenthis.txt`, printing "flag4: There is no place like home".
```

**fix.** Change default credentials and enforce a strong password policy with
lockout. Remove the arbitrary-command feature entirely, an admin panel should
never shell out to user input. Keep the console off the public network, behind a
VPN or an IP allow-list.

## flag 3, reverse shell to password spray to SSH takeover

**critical, [CWE-522](https://cwe.mitre.org/data/definitions/522.html)**

*Where:* host, `www-data` reverse shell → SSH as `mscott`

The command execution from flag 4 was used to spawn a reverse shell as
`www-data`. Enumerating `/home` found user accounts; a password spray with
season-themed guesses (a lecture hint) cracked SSH logins for `dwight` and
`mscott`. Logging in as `mscott` exposed `CONFIDENTIAL.pdf`, which held the flag.

```
hydra -L users -P seasons ssh returned dwight:Fall2025! and mscott:Spring2025!;
scp pulled CONFIDENTIAL.pdf, which contained flag 3.
```

**fix.** Enforce least privilege for the web service account, ban predictable
season-and-year passwords, require SSH keys with MFA, and alert on password-spray
patterns and reverse-shell egress.

## kernel exposure

From `linux-exploit-suggester` on the compromised host, local privilege-
escalation CVEs the kernel was exposed to. Not part of the flag chain, but part
of the risk picture.

| cve | name | exposure | fix |
| --- | --- | --- | --- |
| [CVE-2022-32250](https://nvd.nist.gov/vuln/detail/CVE-2022-32250) | nft_object UAF (NEWSET) | probable | patch the kernel; disable unprivileged user namespaces |
| [CVE-2022-2586](https://nvd.nist.gov/vuln/detail/CVE-2022-2586) | nft_object UAF | less-probable | apply pending kernel updates |
| [CVE-2022-0847](https://nvd.nist.gov/vuln/detail/CVE-2022-0847) | DirtyPipe | less-probable | update the kernel to 5.16.11+ |
| [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034) | PwnKit (Polkit) | less-probable | patch pkexec; drop setuid if unused |
| [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | sudo Baron Samedit | less-probable | upgrade sudo to 1.9.5p2+ |
| [CVE-2021-22555](https://nvd.nist.gov/vuln/detail/CVE-2021-22555) | Netfilter heap OOB write | less-probable | upgrade kernel; disable unused netfilter modules |
| [CVE-2017-5618](https://nvd.nist.gov/vuln/detail/CVE-2017-5618) | GNU screen 4.5.0 LPE | less-probable | update screen past 4.5.1 or remove it |