> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/knife.md).

# Knife

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-aebb25e930efb970a8759d2b38bba5fbd414e50d%2Fimage.png?alt=media)

### PHP-Dev

I found nothing interesting about the web application hosted on port 80. However, when viewing the traffic proxied through Burpsuite, we see an interesting header:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-97e1e314d910ca363a82fd759e8f550659b80362%2Fimage.png?alt=media)

PHP/8.1.0-dev is vulnerable to a publicly available RCE exploit.

{% embed url="<https://www.exploit-db.com/exploits/49933>" %}

This script can be used to gain a shell as the user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e46c33da1779e4f8d887ab758cf3a4715efa563a%2Fimage.png?alt=media)

From this, we can get a shell using the `mkfifo` script. After spawning a TTY shell, we find that we are the user `james`.

## Privilege Escalation

### Knife Sudo

When enumerating sudo privileges, we see that we can run `knife`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e8cf0cc7dc1b33cfc821574bb7f2756f13f3aa0c%2Fimage.png?alt=media)

`knife` can be used to spawn a root shell since we can run `sudo` with it.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b7a5ebc040d1bb0ff9fd165a4cecfbe6af051113%2Fimage.png?alt=media)