Resolution summary

• LFI on main webpage
• Reverse Shell via LFI
• Lateral escalation via weak encrypted password
• Privilege escalation via VNC running as root and password in zip file
• Root obtained and flags captured

Introduction

As an aspiring cybersecurity professional with just over three years of experience in the field, I recently had the opportunity to take the Practical Junior Penetration Tester (PJPT) exam offered by TCM Security. With no prior formal penetration testing experience, my journey has largely been shaped by platforms like HackTheBox and TryHackMe. In this blog post, I’ll share my thoughts and experiences from the perspective of a novice tackling the PJPT exam after completing the “Practical Ethical Hacking” course.

For my first blog post, I’d like to share how I created this blog. My stack utilizes Hugo, AWS S3, AWS CloudFront, AWS Certificate Manager, AWS Route 53, git, and GitHub actions. While this method isn’t the easiest to configure, once its complete it allows you to focus on the whole point of the blog in the first place, writing. If you want an easy method that doesn’t require much technical skill or effort check this out. However, this technical configuration and setup allows us to have more control over our blog and its security.

Now, let’s get started: