Target from: CVE Network

Advanced, Rootable

CVE-2018-11776 / 0.0.0.0

5: Flags (other, 2:system, env, root)
2: Services
1,500 pts

A direct implementation of the CVE-2018-11776 for Apache Struts 2.3.34/2.5.16
#headshot

Level 13 / Junior CTFer

JDgodd / 116th Place

5: Flags found
2: Services discovered
1,500 pts
605 minutes

No bio...

This is a target with direct implementation of the CVE-2018-11776 for Apache Struts 2.3.34/2.5.16 and is here to assist in developing exploits for this vulnerability.

Description

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin).

Environment details

The system is accessible at 10.0.200.169 and runs Apache Tomcat on port 8080/tcp.

JMX Service at on port 8009/tcp.

Flags can be found at:

  • /root/ETSCTF
  • /etc/passwd gecos
  • /etc/shadow password hash
  • env variable
  • http://10.0.200.169:8080/ETSCTF.html url which is also available under /usr/local/tomcat/webapps/ROOT/ETSCTF.html

NOTE: The target IS exploitable, you just need to try harder!!

References

19 Headshots (newer first)

M4sk0ff, Dych0t0m0us, AshBorn77, kobbycber, jaxafed, PufferOverflow, Muzec, Grosik, JDgodd, ElleuchX1, hacker, Pegasus, biba22, sn1per, r0b0tG4nG, TheCyberGeek, AKMalware, abosaif, hitmanalharbi

Activity Stream

Latest activity on the platform

JDgodd managed to headshot [CVE-2018-11776], 39 months ago
JDgodd Discovered the ETSCTF flag from a password file of a server for 300 points, 39 months ago
JDgodd Gained access to data stored in environmental variables of CVE-2018-11776 for 300 points, 39 months ago
JDgodd Discovered the ETSCTF username flag under an authentication database file of a server for 300 points, 39 months ago
JDgodd Got access to the /root folder of CVE-2018-11776 for 500 points, 39 months ago
JDgodd Discovered the hidden resource of a web server for 100 points, 39 months ago
JDgodd Discovered a web service, 39 months ago
JDgodd Discovered a JMX service, 39 months ago