root-me-spip

Date

31 March 2022

Validations

90 Compromissions 9%

Note

8 Votes

Description

Attention : this CTF-ATD is linked to the challenge "Root Me, for real"

At the end of 2021, we were able to authenticate with administrative privileges on the Root-Me backoffice using, among other things, a 0day vulnerability in the SQL engine of SPIP 4.0.0.

The vulnerability has been corrected in version 4.0.1 of the software. This challenge is a simple SPIP site in vulnerable version. Find the bug in your turn, exploit it, and pass root to recover the flag !

Compromission time

4 hours

Operating system

linux

start this virtual environnement

173 Virtual Environnements

Results	Name	Validations	Difficulty	Author	Note
	Challenge SecuriTech	1% 13
	Windows XP pro 01	5% 490		g0uZ
	Exploit KB Vulnerable Web App	12% 305
	Holynix v1	24% 292
	Kioptrix level 2	25% 962
	Kioptrix level 3	33% 569
	Kioptrix level 4	35% 459
	LAMP security CTF4	35% 2687
	LAMP security CTF5	26% 3825
	LAMP security CTF6	18% 599
	Metasploitable	12% 1698
	Metasploitable 2	40% 8342
	Moth	21% 107
	pWnOS	32% 394
	Ubuntu 8.04 weak	5% 205		g0uZ
	Ultimate LAMP	18% 147
	VulnVoIP	17% 826
	VulnVPN	12% 59
	LAMP security CTF8	14% 288
	LAMP security CTF7	39% 879
	Hackademic RTB1	19% 362
	No Exploiting Me	14% 54
	SamBox v1	7% 714		sambecks
	SamBox v2	13% 951		sambecks
	RA1NXing Bots	8% 16
	Murdering Dexter	16% 49
	LoBOTomy	4% 9
	Vulnix	2% 12
	Xerxes	3% 18
	Infernal Hades	6% 15
	SkyTower	24% 212
	Bluebox - Microsoft Pentest	4% 408
	Acid: Reloaded	18% 174
	Acid: Server	12% 212
	CsharpVulnJson	6% 14		notfound404
	CsharpVulnSoap	11% 8
	/dev/random : Pipe	5% 233
	/dev/random : Relativity	7% 96
	/dev/random : Sleepy	4% 44
	brainpan1	4% 82
	LordoftheRoot	25% 227
	Flick 1	9% 64
	Flick 2	10% 10
	FristiLeaks 1.3	29% 214
	The Purge	5% 14
	SickOs: 1.1	13% 90
	Xerxes: 2.0.1	13% 20
	brainpan2	9% 22
	brainpan3	6% 6
	SAP Pentest	7% 284		iggy