✅Haircut (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: Curl Command Injection
System Vulnerable: 10.10.10.24
Vulnerability Explanation: By exposed upload directory and improper validated user input which could allow attacker to upload malicious file and gain access on the system.
Privilege Escalation Vulnerability: screen version 4.5.0 vulnerable to Local Privilege Escalation
Vulnerability Fix: Ensure that unauthorized user could not access to Upload Folder and validate user input extension.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 nginx/1.10.0
A simple webpage and source code nothing is interesting.
Run gobuster to check hidden directory.
Let start our http server on kali machine and replace localhost with our IP address.
Intercept burp proxy, the argument maybe,
we can inject the payload in curl,
Let create a simple file test.html and use curl to upload the file
Let go to /uploads to verify, if we have upload successful.
Confirms that we can upload and execute the file.
Exploitation
Let upload command execute shell.php
Let upload our file to the application
Confirms we can perform command execution.
we can replace command with bash reverse shell and start netcat listener on port 4444
Privilege Escalation
Find misconfigure on SUID
/usr/bin/screen-4.5.0
Let create those two files and compile on our local machine to avoid error.
Let Compile those 2 files.
Let copy the both compile file to our victim machine
Let change the directory to /etc
Check on /tmp
Last updated