# Magic

## Gaining Access

Nmap scan:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/SGrYpjP2nNsWa7tbNOEw/image.png" alt=""><figcaption></figcaption></figure>

### Login Bypass -> File Upload RCE

The web application shows us some random images as a form of portfolio.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/utAc5wWn9yiv1UQNsy0r/image.png" alt=""><figcaption></figcaption></figure>

I did a `gobuster` scan and found a few directories of interest:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/zGmml1ynX4RMbOTiu4hw/image.png" alt=""><figcaption></figcaption></figure>

So there was a `login.php` directory. I didn't have any credentials, so I tried a few low hanging fruits such as `admin:admin` and basic SQL injection. The payload of `' OR 1 --` worked.

Then, I was brought to this page:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/aX3acJFLlqu6qCnEyOKw/image.png" alt=""><figcaption></figcaption></figure>

This was a PHP site so I tried uploading PHP webshells, but it didn't work. As such, I tried to **embed a webshell witihin a JPG file**.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/dppnguCccl1iy8zUTa1m/image.png" alt=""><figcaption></figcaption></figure>

Afterwards, we just need to change the extension to `.php.jpeg` and send the file (via Burpsuite). Earlier, a `gobuster` scan found a `/images` directory, so I used `gobuster` on that to find more directories:

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/eIe7NQnFneekE4C1u1AG/image.png" alt=""><figcaption></figcaption></figure>

So the `/uploads` directory is where our files end up. I tried some basic commands, and it worked!

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/wF0Vax5iAsztTgJYi5f7/image.png" alt=""><figcaption></figcaption></figure>

Getting a shell from here is easy.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/rVPzGUR5F1omXQjUjCQH/image.png" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

### SQL Credentials

In the `/var/www/magic` file, I found a set of database credentials.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/v2lFuXdUP05PoeUA75DL/image.png" alt=""><figcaption></figcaption></figure>

I used `mysqldump` (which was present on the machine somehow) and dumped out all of the SQL stuff.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/cTNqKZfO3yHfoyLYdVwZ/image.png" alt=""><figcaption></figcaption></figure>

I was able to find a set of credentials for the admin user.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/lPCpVryGeD8W5Wn9qXJd/image.png" alt=""><figcaption></figcaption></figure>

From reading the `/home` directory, the user on this machine is `theseus`. These credentials work with `su`.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/4FTQhZD76pH5hsCtlqG3/image.png" alt=""><figcaption></figcaption></figure>

### Fdisk

I checked for SUID binaries, and found one at `/bin/sysinfo`. When trying to execute it, I found that it was executing `fdisk` without the full path.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/5jScBlSvIIVqxiVvYgA0/image.png" alt=""><figcaption></figcaption></figure>

By manipulating the PATH variable and creating a reverse shell script named `fdisk`, I can get a reverse shell as root.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/4xRW1sP4LarMY8jVssdB/image.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/bsNFNvBE4e388jlA6k8K/image.png" alt=""><figcaption></figcaption></figure>

Port 9999 does not work (presumably due to firewall) so I changed to port 443 and ran `sysinfo` again.

<figure><img src="https://content.gitbook.com/content/qpzdj1tPRpELJdvxuVYh/blobs/gtN5JkqQcHGZ8K8kJc4H/image.png" alt=""><figcaption></figcaption></figure>
