✅Magic (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: SQL Injection, Improper Validation
System Vulnerable: 10.10.10.185
Vulnerability Explanation: The machine is vulnerable to SQL Injection which could allow us to bypass authentication. We can bypass file upload and gain shell on the machine.
Privilege Escalation Vulnerability: Misconfigure on SUID
Vulnerability Fix: Sanitize Input and least privilege.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache/2.4.29
Running gobuster to check hidden directory.
SQL Injection
We found a login webpage. Can try SQL Injection. By simply inject ' or 1=1-- - we are in.
Burp bypass Login
By visiting /upload.php, it will response with 302 status code.
Go to Burp > Proxy > Options Tab > Match and Replace
Again visiting the /upload.php it doesn't require authenticate.
Let try to upload file but it accepted only image file extension.
On index.php, there are a lots of photo and the path stored /images/uploads/name.jpg.
Let create a php shell file with magic word of gif and double extension.
Once, we have uploaded, there is another restriction.
Let add PHP code into image file.jpg.
Let uploads, this time it's working and we can confirms code execution.
Exploitation
Let send the request to burp and inject bash reverse shell with URL encoded.
Privilege Escalation
Shell as theseus
Let try to access via SSH with credential but it doesn't work.
Let access through mysql.
mysql localhost
Shell as root
Find misconfigure SUID file.
/bin/sysinfo
Running ltrace with /bin/sysinfo. It's going to run fdisk but not full path.
Let create a file with bash reverse shell and save as fdisk on /tmp.
Export the PATH.
Let start netcat listener on port 5555 and run /bin/sysinfo.
Last updated