search

Writeup

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.95.203
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-06 11:25 EDT
Nmap scan report for 10.129.95.203
Host is up (0.14s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

hashtag
Port 80 -> SQL Injection

Port 80 just hosts this image:

This thing says that it is banning IPs that send too many requests, so a directory scan might be counterproductive. Instead, based on the text, going to /writeup works.

Viewing the page source reveals that this is using CMS Made Simple:

There are loads of exploits for this software.

I tried a few of them, and only the SQL Injection one worked.

With this, we can ssh in as jkr.

Grab the user flag.

hashtag
Privilege Escalation

hashtag
PATH Hijacking

I ran a LinPEAS scan to enumerate for me, which found that we are part of the staff group that can write to certain directories:

Having write access to these directories means that we can do PATH hijacking by creating an executable in those files with the same name as processes run by root. As such, I downloaded pspy64 onto the machine to see if root was running any processes without full paths.

When run, I saw these processes that were run:

The run-parts command did not have a full path, meaning that we can exploit this. We can create a basic bash script that makes /bin/bash an SUID binary. Then we can download it into the /usr/local/bin directory:

Afterwards, we just need to ssh back into the machine to execute it and get a root shell.

PreviousWifineticNextMedium

Last updated