# Oopsie

## Initial Scan

```nmap
sudo nmap -T4 -Pn -sV -sC -v 10.129.95.191 -oA Oopsie
```

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FMk3dCpq0P4BinLCO8KpJ%2Fimage.png?alt=media&#x26;token=9318ced7-490d-4e00-bf12-40963afd7731" alt=""><figcaption></figcaption></figure>

## Task 1

With what kind of tool can intercept web traffic?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F5X7JzyXjaXEERZFctS0W%2Fimage.png?alt=media&#x26;token=b923d702-db7e-4873-8622-5bc2be7b546f" alt=""><figcaption></figcaption></figure>

Answer: Proxy

## Task 2

What is the path to the directory on the webserver that returns a login page?  Answer: /cdn-cgi/login

## Task 3

What can be modified in Firefox to get access to the upload page?

Answer: Cookie

## Task 4

What is the access ID of the admin user?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F0Cd1ZDrP7iYy6jkwRLIw%2Fimage.png?alt=media&#x26;token=f2c5a5a5-1d50-4d1c-808a-64d38b3fdcee" alt=""><figcaption></figcaption></figure>

Answer: 34322

## Task 5

On uploading a file, what directory does that file appear in on the server?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FNK1f0FnFvOF3T1bTgABR%2Fimage.png?alt=media&#x26;token=ef2aad1c-09e0-41db-b1d0-b43fac273ba2" alt=""><figcaption></figcaption></figure>

Answer: /uploads/

## Task 6

What is the file that contains the password that is shared with the robert user?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2Fqy2TbhXB6foWHa4YOIV5%2Fimage.png?alt=media&#x26;token=5978916c-26d6-464e-8299-ae4611ddad50" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FUojtWQnSIrcf273Q9qZC%2Fimage.png?alt=media&#x26;token=edcd11f2-cdcc-46dc-afd0-e3cc591abd10" alt=""><figcaption></figcaption></figure>

Upgrade to a functional shell:

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

&#x20;

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FiMTO9LP1yQmJaJ1WUgkm%2Fimage.png?alt=media&#x26;token=840f6ba4-69d9-4671-80d0-d3f97ce8ecb0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FRxBuE1OS9YuyVDbjE1zM%2Fimage.png?alt=media&#x26;token=bd4e538f-60bc-409c-9415-5cbe51b92624" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FmKTiv4vnBY32E1OZVyTH%2Fimage.png?alt=media&#x26;token=6e09ec60-397e-47bf-8767-6d4e988ec6f4" alt=""><figcaption></figcaption></figure>

Answer: db.php

## Task 7

What executible is run with the option "-group bugtracker" to identify all files owned by the bugtracker group?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FWrAqPDrzAjH90Aa2mNqw%2Fimage.png?alt=media&#x26;token=3d26b037-921a-412c-835e-05a117c56e04" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FbClJ9uFc8KEZmwGZjKVq%2Fimage.png?alt=media&#x26;token=c6d319cc-9519-4123-99c0-48085f2e77a7" alt=""><figcaption></figcaption></figure>

Answer: find

## Task 8

Regardless of which user starts running the bugtracker executable, what's user privileges will use to run?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FzMg5IC8lKmwfhiQgXMol%2Fimage.png?alt=media&#x26;token=21de7dfb-9c79-494f-86be-e3d6f0161e89" alt=""><figcaption></figcaption></figure>

Answer: root

## Task 9

What SUID stands for?

Answer: Set owner User ID

## Task 10

What is the name of the executable being called in an insecure manner?

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FPqnZoiXq2QmtlVS6iFka%2Fimage.png?alt=media&#x26;token=00848c82-5c74-4b15-b8b7-5b20d2420c17" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FtsV0pGCnKDxDzoXrD73r%2Fimage.png?alt=media&#x26;token=563f71f9-1b77-4ead-9382-b44bdfb0976e" alt=""><figcaption></figcaption></figure>

Answer: cat

## Task 11

Submit User Flag

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FpQP7R1Q6g41g6J0QZSVN%2Fimage.png?alt=media&#x26;token=3bf16386-f743-43c5-8d33-eeeb8c787332" alt=""><figcaption></figcaption></figure>

Answer: f2c74ee8db7983851ab2a96a44eb7981

## Task 12

Submit Root Flag

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F7MeimRuitRRcUOnJGzVi%2Fimage.png?alt=media&#x26;token=68073522-4dfe-48e3-ae15-1f615b6dab64" alt=""><figcaption></figcaption></figure>

<figure><img src="https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FjaCkYdAJGMyoMUw0pllp%2Fimage.png?alt=media&#x26;token=24686b1a-fc3b-4cbf-9855-d1fa40dc9aea" alt=""><figcaption></figcaption></figure>

Answer: af13b0bee69f8a877c3faf667f7beacf