NoName
Summary
This machine starts with good enumeration of Web applciation that leads to hidden endpoints, one of these endpoints is obviously executing a shell command trough for submission. Testing this last form submission leads to command injection (with a twist to bypass filter) and achieving shell access to the machine as user. From the user an exploitable SUID executable can be identified and leads to root access.
Nmap Scan
Foothold
Only HTTP port 80 open so I start by looking there
I tried submitting a fake query and it was submitted to index.php
Next I went with a ffuf scan to bruteforce any directories or files on the server, this lead me a 2 new pages, /admin and /superadmin.php
admin page only showed some pictures
the more interesting part was superadmin.php page which had a form that can be used to execute ping command
Also the hidden superadmin.php endpoint is also identifiable through steganography through admin page
Initial Access
With access to superadmin page and the ping command executing in place I tried to identify a command execution and that worked with pipes
So now I had to find some way to exploit that to get access, I noticed some commands where not executing so I figured there was some kind of filter on the input, to understand the filter better I went on a printed the php code of the file superadmin.php.
Get dj4m’s stories in your inbox
Join Medium for free to get updates from this writer.
The output was not visually intereseting but the page source showed the code
now I can see the filter and figure the commands that i cannot use to bypass that and achieve a reverse shell I figured a method to bypass the filter, I could used pass my payload in base64 format and use piping to decode then execute the payload!
Using this workaround I was able to get reverse shell and get local.txt flag
the payload decodes to this command
Privilege escalation
To get Root I was able to identify SUID executable ‘find’
the checking on
I found this SUID exploit that lead me directly to root and proof.txt falg
