---
description: Step-by-step guide on the approach taken to pwn the machine.
---

# Write-up

### <mark style="color:purple;">Objectives</mark>

In this machine, we need to retrieve two specific items: **user flag** and **root flag.**

***

### <mark style="color:purple;">Reconnaissance</mark>

We begin by running an **nmap** scan to discover open ports on the target machine:

```bash
sudo nmap -F <ip_victim>
```

The **-F** flag scans the top 100 most common ports.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfzz7NDNafynoWCZYb28WrxqYOX-n8Ij8ePxe5EMTQNu6CW2tPI1H-5MM0UcL42hGtcKEDx_ja2WcFTbWBpkl0flxnJyakHbvquO1IcGOgPpCs4_3ku3F_UKWI5AIIT3Qu7lz4Qzw?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>

The scan reveals two open ports:

* **22** (SSH)
* **80** (HTTP)

Since we currently lack SSH credentials, we explore port **80** by visiting:

```bash
http://<ip_victim>:80
```

We find the default Apache template indicating successful configuration but no other visible content. We proceed with **dirbuster** to identify potential directories.

***

### <mark style="color:purple;">Directory Enumeration</mark>

Dirbuster quickly reveals several directories, including **/content** and **/icons**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeebAmJIstAm2ubOkzV13Fo_V2lvcB33AN_uZevsMiS34C-KUpuySG-4fw1fjXVtt9vRSx91-C9WZ4BQxMuoTJwXBBN3eNQMqQAIvH0cbQcgkVofVmDEMHokB8x9dQKa6wrzNXvfA?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>

We inspect **/content**, which appears promising.

Inside, we find a welcome message for **SweetRice**, a website management system. The message mentions the site is under construction and can be opened by unchecking "Site close" in the admin panel.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdRrzr30LaE67KUw8KuL0kIaHzJb-vuYt9Jx7xjPOaGV90hUhwXrVvVcK0knnkHZOvU8jItU7-rfDU3-MGKBQN9SWAAiOrsQeG8o56kWdH8xfWrFjO3W6GsFV-JPiQIylKBigy6oQ?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>

Continuing with **/content/inc/**, we find three notable items:

* **htaccess.txt**: No significant information.
* **lastest.txt**: Indicates the version of SweetRice (1.5.1).
* **mysql\_backup/**: Contains a database backup.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcER5X7ZHcfUwBeagmqKbrf6kAWB3Td3FyiDefiSqGwFa5C6mu5jqrhhWQHeclOWwYR2EBmcOxWSQJWz0f6EsfQ5KUNaeTrr4ViVxbyylS91a4oHJBEiXcEmTsA0sCSUlytLlPRag?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>

***

### <mark style="color:purple;">Exploitation</mark>

We download the database file from **mysql\_backup/** and examine its contents.

The database includes several tables:

* **category**, **comment**, **item\_data**, **item\_plugin**, **links**, **options**

Further down, we discover what appears to be a username and a hashed password.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf4Wywd14hZJAtQIM9yVz4lTzKTfFC299BtZReZIja3s1VmaV4updhSbSVqwZHQc2lxJLQZg_uCbR8kTqASRJklRsEUHvyfm6sn8Uj9Z5VDxQnZzL5lTebqvLDPKXnBTM3baRqkjw?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

To identify the plain text password, we use [**crackstation.net**](https://crackstation.net).

The hash is in **MD5** and translates to **Password123**. This gives us potential credentials:

```
Username: manager
Password: Password123
```

***

### <mark style="color:purple;">Admin Panel Access</mark>

We continue with **dirbuster**, which reveals **/content/as/**, the admin login page. We attempt to log in using the discovered credentials.

The login is successful! We confirm the CMS version is **1.5.1**.

<figure><img src="https://657071395-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6TULCIQYFngHxc4snxrs%2Fuploads%2FakJGLKitLiuH00cX1Qcn%2Fimage.png?alt=media&#x26;token=672a8477-03a2-41e1-9b60-0a6929c89b3a" alt="" width="331"><figcaption></figcaption></figure>

***

### <mark style="color:purple;">Vulnerability Exploitation</mark>

We search for vulnerabilities on [**exploit-db.com**](https://exploit-db.com) for SweetRice **1.5.1** and find five verified exploits. We choose the **CSRF / PHP Code Execution** exploit.

The exploit suggests modifying the **Ads** section of the admin panel. We adjust the **action** value in the exploit script to point to:

```
/content/as/
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeZP8UwE0kqeQGtoZGPZweee0a-S07Frbrmb7828tJFQxNqSt2ckY6trlwLBiPJwb-ebOrA_v2MREg3xDSqzQTkbBQA4LDY3AKxuHcxUR492xHHhohhFTwVTaI5dqz4RYvK1cDlZA?key=VvcS6hkqkqZTxLZukJQWNuQU" alt=""><figcaption></figcaption></figure>

We save the script and execute it by accessing **/content/inc/ads/**.

A brief message reading 'Hacked' appears for two seconds, followed by a new ad titled 'hacked', confirming the exploit worked.

***

### <mark style="color:purple;">Reverse Shell</mark>

We replace the exploit script with a reverse shell payload, using the [**pentestmonkey**](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php) PHP reverse shell.

Before saving, we modify two variables:

* **$ip**: Our IP address (found using **ifconfig** under **tun0**).
* **$port**: The port for the connection (**4444**).

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcfOTyfkfROAFL2K-cI_X3hFmHdxyTADs-hnmGnCZY1HXw5dL2JTf_E0DZH04gm39S1b-XJXZ5qM4x2efgjP3V7gMVuyX7q5d60EfiGGfFLCi-qzvqRd2p4Y88-A2xznqfsXV41jw?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

We start a listener on our local machine:

```bash
nc -lnvp 4444
```

* **nc**: Netcat, the tool to listen on a port.
* **-l**: Listen mode.
* **-n**: Numeric-only IP addresses.
* **-v**: Verbose output.
* **-p**: Specify the port.

Upon executing the modified script, the page keeps loading, and our listener confirms we have shell access.

Running **whoami** reveals we are **www-data**. We retrieve **user.txt** from the home directory.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfOMD3Dz6S07bDocJ3YcXEvxJ4QaMNuFb9JbcfU_Lr0pdtCbE-UtAXc7AEAcLFe0kudffGf54MXOPlqG7x69J1oqVGMPaFLSI1fi73ptEa_i-LG_puf4MwI_rfLzUrNdpYk2o6ZtQ?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXffO9wCYshw2xCMeFDI0HwrWIRvSf6WInO1jWaJ5wdgXMGYti1g9wa92d-pDNwrvt_uIiNTbrbEyRdC14BckNlmo4jYN3Q3SfnZI8bf_g703p0Qdrx-hEz1fClas_0Z-6Hv6DM63Q?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>

***

### <mark style="color:purple;">Privilege Escalation</mark>

To escalate privileges, we check what we can execute with sudo:

```bash
sudo -l
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc45ajn5qhht5oKree3OXyTYJz2tPvp4gyDgIEyN2GUMf4iQsC1U-jseNQaAZEGVddFUZv9wiwfedWFUYWJle56ZTxhEQOTE3AcTRaJD720a-Pn59NsqQiAF6Nlzug8zgbjx3aC?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

We find we can run the following as root without a password:

```perl
/usr/bin/perl /home/itguy/backup.pl
```

We inspect **backup.pl**:

```bash
cat /home/itguy/backup.pl
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdM3hwXTAfnW9e1fVKiTRqkfzNoXAwWA6Y0vWqLVD1fkwz2Sbj-qTiOQeYOI39wH7faNOomCICm4lLEHeOcRl6YdEXCViVQ1u6hKb6WISWknycYszwk_4brNrEenpLb3zcgQLNyVw?key=VvcS6hkqkqZTxLZukJQWNuQU" alt=""><figcaption></figcaption></figure>

The script executes **/etc/copy.sh**. Inspecting **copy.sh** shows a shell connecting to **192.168.0.190:5554**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXd7bMwydrEhr7TeWHAkIdwKCmPrkZzFcQKGdZBE_UY4qcYgWXpuG5rOKd41bfDkh7W2UNpgSYXSZnJCokaCx_6sFkJniqDAGYsuFbXb16xyIWPmfDN5DzHTARwrVzrG1XMJmzS9?key=VvcS6hkqkqZTxLZukJQWNuQU" alt=""><figcaption></figcaption></figure>

To gain root access, we overwrite **copy.sh** with a bash shell:

```bash
echo "/bin/bash" > /etc/copy.sh
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdn83HeD6Ebu3WCXKpJNLHsFPyt255Humqr3Sxrpv1YbbigHfwHNXAHP1i97yoTFWmOM5YzEy7LotGBlan19AFbRIPOOp6vWcCFk1Dxkf2ZxRiMEjbuJkzd5RPSTIVt0wmnbRiF3A?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

We run the script as sudo:

```perl
sudo /usr/bin/perl /home/itguy/backup.pl
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfWE3L6x43jMtsLJOtX2zjhY-qTHR_Xd1dzXtH3ZzL_7GW3rmsTYgzyKwp5H-m3qFqevZZRBxpSbdzT9IyyaC6u4xZ6ZGEm5RIWmT9Kk61KtwCpyao89-EGMonSxlazFJkjlcXjqQ?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="563"><figcaption></figcaption></figure>

Running **whoami** now confirms we are **root**. We locate **root.txt** and read its contents.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc1ct1Sd7XSnV-mGtyCgzg8y5c0SGkGaFpZbFG3Omgwyw1kB4PoZTTFZjrTkbsCnXi6Twj2yEbbuxsPNlPvXe0Zrd0lwkROByvtlkREO83EBv2MTD2EpTrdjtqLAad7gvCxTOf9DQ?key=VvcS6hkqkqZTxLZukJQWNuQU" alt="" width="375"><figcaption></figcaption></figure>
