> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/traceback.md).

# Traceback

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-94600258c0a0d1c8f899495927e988c9c4bbf4c0%2Fimage.png?alt=media)

### Finding Backdoor

Going to the website revealed that this website has some sort of backdoor left on it.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4f7962d028b58eaa991593c4cc30ea44bb0a2895%2Fimage.png?alt=media)

Reading the page source gave another hint:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7e42e2940cc4ef6fafd06bbf8b5005aba576716c%2Fimage.png?alt=media)

For this, we can google 'Some of the best web shells that you might need' and be directed to this repository:

{% embed url="<https://github.com/TheBinitGhimire/Web-Shells>" %}

From there, we can create a wordlist of all the possible shells that are available, and use `gobuster` on the website. We would find that `smevk.php` is on the website.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ad5fa39da36a169118330f4779bc71f7ae2c3a6d%2Fimage.png?alt=media)

We can login with `admin:admin` and then find a functioning PHP web shell.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6f5245dfbe76754bd1ed7a8d16af06ff5f6e587b%2Fimage.png?alt=media)

Using the Execute part, we can gain a reverse shell on the machine as the `webadmin` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b6b27ef2122abc3fa4181ca8e00d7ff877d79f54%2Fimage.png?alt=media)

## Privilege Escalation

### luvit

We can first check our sudo privileges.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-51d95cd9c8e034366ce2550075a6cd1293d7c812%2Fimage.png?alt=media)

There's also a message left behind by the `sysadmin` user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b1fb1fc1def834ea4fc4b7751c0f7a1e0e488cf0%2Fimage.png?alt=media)

`luvit` is a CLI tool that can be used to execute LUA code. Since we can use sudo on it, we can simply spawn in another shell using `os.execute()`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-76e478b36ca41db6b7200eac9cc4f80e3af08814%2Fimage.png?alt=media)

### Motd-d

When running LinPEAS, we can find that there are some interesting files we can write to:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-21c1b174053ad83df976cddd89aa72d667aceedd%2Fimage.png?alt=media)

To exploit this, we would need to trigger the message to be displayed through SSH. As such, we can create a public key and echo it into the `authorized_keys` file for `sysadmin`. Afterwards, we need to execute this command:

```bash
echo "cp /bin/bash /home/sysadmin/bash && chmod u+s /home/sysadmin/bash" >> 00-header
```

This would create a `bash` SUID binary for us to escalate privileges. This 00-header file would need to be placed within the `/etc/update-motd.d/` file and then we can SSH in. Afterwards, spawning a root shell is simple.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3c3941b1ab53681f652bfb55d3ea3795761c2e33%2Fimage.png?alt=media)