root-me-spip

Data

31 marzo de 2022

Validaciones

103 Compromissions 9%

Nota

9 votos

Descripción

Attention : this CTF-ATD is linked to the challenge "Root Me, for real"

At the end of 2021, we were able to authenticate with administrative privileges on the Root-Me backoffice using, among other things, a 0day vulnerability in the SQL engine of SPIP 4.0.0.

The vulnerability has been corrected in version 4.0.1 of the software. This challenge is a simple SPIP site in vulnerable version. Find the bug in your turn, exploit it, and pass root to recover the flag !

Tiempo de compromiso

4 horas

Sistema operativo

linux

iniciar este entorno virtual

177 Entorno virtuales

Resultados	Nombre ↓↑	Validaciones	Dificuldad	Autor o autora	Nota
	/dev/random : Pipe	5% 236
	/dev/random : Relativity	7% 97
	/dev/random : Sleepy	4% 44
	3mrgnc3 - 64Base	10% 53
	3mrgnc3 - D0Not5top v1.2	17% 19
	6Days Lab - v1.0.1	12% 39
	A bittersweet shellfony	12% 234		mayfly
	ARM FTP box	4% 73		chaignc
	ARP Spoofing EcouteActive	0% 0		voydstack
	ARP Spoofing Man In The Middle	0% 0		o71, voydstack
	Acid: Reloaded	18% 176
	Acid: Server	12% 219
	Analougepond	13% 48
	AppArmorJail1	0% 0		nivram
	AppArmorJail2	0% 0
	Apprenti-Scraper	0% 1
	Awky	8% 497		sbrk
	BBQ Factory	6% 125		sm0k, dvor4x
	BLACKLIGHT	8% 40
	BSCorp - Unix	5% 201		ghozt, mayfly
	BSides-Vancouver-2018-Workshop	27% 47
	Bash considered harmful	8% 138		sbrk
	Basic pentesting 1	32% 4749
	Basilic	4% 19
	Bee-box v1	6% 41
	Billu-b0x	8% 34
	Billu-b0x2	9% 123
	BlackMarket	11% 67
	Bluebox - Microsoft Pentest	4% 420
	Bluebox 2 - Pentest	3% 311		sambecks
	Bob v1.0.1	26% 87
	Born2Root	9% 169
	Born2rootv2	34% 92
	BreakingRootme2020	15% 521		Laluka
	Bulldog	27% 195
	Bulldog2	13% 31
	C for C-cure	5% 15		nikost
	CH4INRULZ v1.0.1	15% 29
	CTFair	0% 0
	Challenge SecuriTech	1% 13
	Command Injection OS	19% 58
	Covfefe	35% 52
	CsharpVulnJson	5% 14		notfound404
	CsharpVulnSoap	9% 8
	DC-1	15% 348
	DC-4	17% 160
	DC-6	30% 115
	DC-7	27% 49
	DC-9	32% 110
	DC416 - Baffle	0% 0