Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CTF-CVE-2019-9053-GTFOBins — Step-by-step CTF walkthrough demonstrating CVE-2019-9053 SQL injection exploitation and GTFOBins-based privilege escalation on a CMS Made Simple target. | Kitploit
Tools/GitHubGitHub/jtoalu/ctf-cve-2019-9053-gtfobins
Password CrackingPrivilege EscalationReconnaissanceVulnerability AnalysisExploitationWeb Application ExploitationCTFPenetration TestingLearning & Education

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
GitHubjtoalu/ctf-cve-2019-9053-gtfobins

CTF-CVE-2019-9053-GTFOBins

Step-by-step CTF walkthrough demonstrating CVE-2019-9053 SQL injection exploitation and GTFOBins-based privilege escalation on a CMS Made Simple target.

View Repository
52 years agoNot yet reviewed

CTF, CVE-2019-9053, GTFOBins

I utilized the machines on https://tryhackme.com/ and my own Kali on WSL to do this exercise and it is part of the CTF challenge. The following information helped me solved the challenge:

  • vim on https://gtfobins.github.io/gtfobins/vim/ and https://gtfobins.github.io/
  • sudoers on https://help.ubuntu.com/community/Sudoers
  • sudo on https://www.geeksforgeeks.org/sudo-command-in-linux-with-examples/
  • CVE-2019-9053 on https://nvd.nist.gov/vuln/detail/CVE-2019-9053 and https://www.exploit-db.com/exploits/46635 and https://github.com/Mahamedm/CVE-2019-9053-Exploit-Python-3/blob/main/csm_made_simple_injection.py
  1. Nmap was utilized to find information about the target machine. nmap -sC -sV -O -p- -oN CTF 10.10.46.2 can be utilized.

  1. The result shows there is a website running on the target machine. Tools such as https://www.kali.org/tools/dirbuster/ and https://www.kali.org/tools/gobuster/ can be utilized to find out any other information about the website. The result contains several information and the /simple is the most useful information on this challenge. After navigating to the simple folder/path/directory of the website, we found a website running on https://www.cmsmadesimple.org/

  1. Scroll down the webpage and we shall find the version of the CMS which is 2.2.8 and it has CVE-2019-9053 vulnerabilities. The information about CVE-2019-9053 is available on the top section of this documentation.

  1. The Python code on https://github.com/Mahamedm/CVE-2019-9053-Exploit-Python-3/blob/main/csm_made_simple_injection.py can be utilized to execute a SQL Injection on the website.

  1. The wordlists utilized to crack the password are available in the TryHackMe AttackBox.

  1. We found the username and password in through the SQL Injection and we utilized the information to ssh into the target machine.

  1. We execute sudo -l to check whether there is a possible of GTFOBins and we found https://gtfobins.github.io/gtfobins/vim/

  1. After executing vim -c ':!/bin/sh' through a regular user account, we obtain an access to the root account.

Note to Self: https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax and https://stackoverflow.com/questions/11509830/how-to-add-color-to-githubs-readme-md-file

Download Tool