Boolean

Initial Reconnaissance

We start by scanning all TCP ports on the target to find any open services. The -A flag enables aggressive scan options like version detection, script scanning, and OS fingerprinting.

sudo nmap -A -sC -sV -T4 192.168.222.231 -p- --open -v -oN tcp_scan.nmap

Scan result:

Key flags explained:

• p-: Scans all 65,535 TCP ports
• sC: Runs default scripts (useful for basic enumeration)
• sV: Detects service versions
• A: Aggressive scan (includes OS detection, version detection, traceroute, and script scanning)
• oN: Outputs results in a readable text file

Key findings:

• Port 22: OpenSSH 7.9 - SSH service
• Port 80: HTTP web server (with a login page)
• Port 33017: Another HTTP service running Apache (labelled “Development”)

Enumerate Web Directories with Gobuster

We use Gobuster to brute-force possible web directories using a built-in wordlist.

gobuster dir -u http://192.168.222.231 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

Results:

• /login: A login form
• /register: A registration page

Register a User

Navigating to http://192.168.222.231/login, we see a login page.

Navigating to http://192.168.222.231/register, we see a register page.

Register a test user with the following details:

• Username: test
• Email: test@test.com
• Password: test123

After registering, the app says a confirmation email has been sent but we don’t actually have access to that inbox.

Bypass Email Confirmation (Burp Suite)

When we try to login using the credentials we registered, we are prompted to confirm our account by clicking on the confirmation link sent to our email (test@test.com).

Using the Burpsuite, intercept the request of the Change mail. and send it to the repeater.

In the response, we can see a parameter confirmed: false.

Modify the request by appending the following:

&user%5Bconfirmed%5D=True

Send the request. Now you can log in using your test credentials.

Explore File Uploads

When we log in as our test user, we are directed to the File Manager.

Try uploading .php and .txt files to test what files are allowed.

When you upload and click on a file, the URL changes like this:

/?cwd=&file=test.txt&download=true

This tells us the app likely supports downloading files from specific paths.

Exploiting Local File Inclusion (LFI)

LFI lets us trick the server into loading files it shouldn’t. Let’s try pulling the system password file.

Change the current working directory to /etc using directory traversal and attempt to download the passwd file.

http://192.168.203.231/?cwd=../../../../../etc&file=passwd&download=true

This works! We’re able to see system users. One user is named remi.

Next, let’s navigate to Remi’s home directory and attempt to access .ssh directory within it:

http://192.168.203.231/?cwd=../../../../../home/remi&file=.ssh&download=true

Now we have access of the .ssh folder and we can upload the authorized_keys.

SSH Access as Remi

Generate an SSH keys in the Kali Machine:

ssh-keygen
cp /home/kali/.ssh/id_ed25519.pub authorized_keys

Upload authorized_keys to /home/remi/.ssh/ via the file manager.

Connect via SSH using your private key:

ssh remi@192.168.203.231 -i id_ed25519

We successfully gained access as the user remi. The user flag local.txt is located in the /home/remi directory.

Privilege Escalation to Root

Look in the ~/.ssh/keys/ directory:

ls /home/remi/.ssh/keys/

There is a private key for the root user here. Use it to SSH into root locally:

ssh -o "IdentitiesOnly=yes" -i ~/.ssh/keys/root root@127.0.0.1

Now you are root! The root flag proof.txt is present in the /root directory.

References

• https://medium.com/@raj.patel33605/boolean-offsec-proving-groundswriteup-8f626bbb1b3f
• https://medium.com/@tipstosecure/boolean-lab-walkthrough-offsec-proving-grounds-881574d0e57c
• https://medium.com/@gleasonbrian/offsec-proving-grounds-boolean-writeup-9c7f5b963559
• https://readmedium.com/boolean-lab-walkthrough-offsec-proving-grounds-881574d0e57c