> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/medium/magic.md).

# Magic

## Gaining Access

Nmap scan:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cd87243a80fd76b78c53b910e7199de4c0810524%2Fimage.png?alt=media)

### Login Bypass -> File Upload RCE

The web application shows us some random images as a form of portfolio.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-edd0eee88e238b723e2c521f25bf01fb85d9c5ca%2Fimage.png?alt=media)

I did a `gobuster` scan and found a few directories of interest:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8aac4249c5bd58802fb4d2989ac53f991c164845%2Fimage.png?alt=media)

So there was a `login.php` directory. I didn't have any credentials, so I tried a few low hanging fruits such as `admin:admin` and basic SQL injection. The payload of `' OR 1 --` worked.

Then, I was brought to this page:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4a07e1875529e452524cad36b3c567e6b0ccc1fd%2Fimage.png?alt=media)

This was a PHP site so I tried uploading PHP webshells, but it didn't work. As such, I tried to **embed a webshell witihin a JPG file**.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1bd812a6297d5fb3fffc0b6f22af0d38b574bca6%2Fimage.png?alt=media)

Afterwards, we just need to change the extension to `.php.jpeg` and send the file (via Burpsuite). Earlier, a `gobuster` scan found a `/images` directory, so I used `gobuster` on that to find more directories:

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-068716c4c96de62d1160d2d66c8902b6bb35a0f5%2Fimage.png?alt=media)

So the `/uploads` directory is where our files end up. I tried some basic commands, and it worked!

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-218d83f412e357d809e6c1683239ebe92a489346%2Fimage.png?alt=media)

Getting a shell from here is easy.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-30d297ca5abb9f1724e6553ac36a9b7cb210c206%2Fimage.png?alt=media)

## Privilege Escalation

### SQL Credentials

In the `/var/www/magic` file, I found a set of database credentials.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-25f5d70ebd760b8d9134575cbed3c310ac536f32%2Fimage.png?alt=media)

I used `mysqldump` (which was present on the machine somehow) and dumped out all of the SQL stuff.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-26a57a064916677325e581f876ec5b337378ff40%2Fimage.png?alt=media)

I was able to find a set of credentials for the admin user.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e2d258dea1c9a1b94215b8cb355e7a83f1657012%2Fimage.png?alt=media)

From reading the `/home` directory, the user on this machine is `theseus`. These credentials work with `su`.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-ccde999ca463cf35e79a9cfab33962293a16d5e3%2Fimage.png?alt=media)

### Fdisk

I checked for SUID binaries, and found one at `/bin/sysinfo`. When trying to execute it, I found that it was executing `fdisk` without the full path.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-56a4c9d1baedca456306068de643715c9e9ed10c%2Fimage.png?alt=media)

By manipulating the PATH variable and creating a reverse shell script named `fdisk`, I can get a reverse shell as root.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e1598534715e9ac99070e8da3394a94ff7967fd5%2Fimage.png?alt=media)

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b25a4804fbe2d5acf16d8a4711eb1213f7ef3fe7%2Fimage.png?alt=media)

Port 9999 does not work (presumably due to firewall) so I changed to port 443 and ran `sysinfo` again.

![](https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-430708e51b35bc02575cfec6fbbeb3fc2e5c2957%2Fimage.png?alt=media)