This box was downloaded from VulnHub and is also on the TJnull list of practice boxes for OSCP preparation. The box involved the follows:

  • Web enumeration
  • Exploiting the php bash shell to get the initial shell
  • Exploiting the cron job for privilege escalation

I always start my enumeration from the autorecon scan. Initial Nmap scan results are as below:

Scanned at 2022-04-25 18:44:39 EDT for 11s
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.18 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Arrexel's Development Site
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-favicon: Unknown favicon MD5: 6AA5034A553DFA77C3B2C7B4C26CF870
Device type: general purpose
Running (JUST GUESSING): Linux 3.X|4.X (87%)
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
Aggressive OS guesses: Linux 3.11 - 4.1 (87%), Linux 3.16 (87%), Linux 4.4 (87%), Linux 3.13 (85%)
No exact OS matches for host (test conditions non-ideal).

Uptime guess: 0.012 days (since Mon Apr 25 18:27:59 2022)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=259 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE (using port 3389/tcp)
HOP RTT      ADDRESS
1   11.76 ms 10.10.14.1
2   11.75 ms 10.10.10.68

There is only one port open, port 80. Let’s start with the web enumeration.

According to the homepage, the developer mentioned that there is a phpbash running in this server. Let’s try to find it.

A quick gobuster scan showed a few interesting directories.

I am particularly interested in /dev and /uploads.

I found the phpbash developer mentioned.

Quickly I tried to run some bash / nc reverse shell commands but it didn’t work. There must be some sanitization of the commands. I tried uploading the file to the /dev directory and it was permission denied.

I moved back to html directory and tried uploading a malicious php file but the www-data does not have write permission in that directory either. From our gobuster scan, I remember we had /uploads . Let’s try that folder.

And I was able to upload the pentestmonkey PHP reverse shell script.

Let’s try to execute that php file. And I got the reverse shell.

Let’s get the user.txt file.

Now running the sudo -l command I can see that the user can run any command as user scriptmanager .

No I switch the user to scriptmanager.

sudo -u scritmanager /bin/bash

Now I looked around but didn’t find anything interesting. So I uploaded the linpeas script. Looking at the results from the script I found an interesting folder that has write permission by the user scriptmanager. /scripts

Inside the directory, there are two files.

Interesting files, let’s see the content of the python script.

So the script basically opens the file test.txt and writes testing 123! to the file. But, as seen from the picture above, test.txt is owned by root and when we run the python script it cannot write the file and returns a permission denied error.

But when we look at the content of test.txt file it has testing 123!. It only happens if the script is run by the root user. Let’s see if there is any cron process going on. I will be using pspy to seek any process run by root.

There is indeed a cron process running every minute, where the root user is running the python script. Let’s change the python script and insert the malicious reverse shell script for privilege escalation.

Now I wait for the reverse shell.

This box is easy rated and was fun to do.