> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/backdoor.md).

# Backdoor

## Gaining Access

First we start with an Nmap scan as usual.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-5656e93095b952cc09f68a49832140314db2edf3%2Fimage.png?alt=media)

We can check out the HTTP server.

### Wordpress Instance

The HTTP server was powered by Wordpress, so immediately we can run `wpscan` to check for common exploits. However, this didn't really reveal much for me, and I wasn't able to amke this work.

### Port 1337

This was a port I had never seen before. A bit of googling revealed that this was a **remote gdbserver** being hosted on the website. There are many easy ways for us to upload a file and gain a reverse shell.

{% embed url="<https://book.hacktricks.xyz/network-services-pentesting/pentesting-remote-gdbserver>" %}

I was really lazy, so I got the the `exploit/multi/gdb/gdb_server_exec` module from MSF to do the work. In my testing after rooting, I could not make the PoC work for me. Strange.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fd7396c65ee112c1a7d77dd9043d6c114eac2f08%2Fimage.png?alt=media)

Now we can grab the user flag easily.

## Privilege Escalation

I ran linpeas as early enumeration to see what was going on. Linpeas flagged out that `screen` was being run by root.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b67c423ca87a54ea8bf816f6a65c0e52469f3ba3%2Fimage.png?alt=media)

`screen` is a software that allows for us to run multiple screens on a single terminal. Root running this means that the root user has multiple screens that are running some processes currently. The attack in this case would be to attach ourselves to this process.

In this machine's case, what it is doing is creating a folder in the S-root directory with a session ID whenever it runs. This would allow us to find the specific process that we want to attach ourselves to.

Using the `screen` command itself, we can do the following to gain a root shell.

```bash
screen -x root/<PID>
```

However, this complains about a 'missing terminal type'. What remedies this is running the following commands to spawn a TTY shell

```bash
export TERM=xterm
python3 -c 'import pty;pty.spawn("/bin/bash")'
screen -x root/<PID>
```

This would drop us in a root shell and we can read the flag.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-06463ca3c2e2bcb66939aac6059795b1f5b891e2%2Fimage.png?alt=media)