# Write-up

### <mark style="color:purple;">Objectives</mark>

In this machine, we are tasked with completing three distinct stages: Reconnaissance, Gaining a Shell, and Privilege Escalation.

***

### <mark style="color:purple;">Reconnaissance</mark>

Let's start with the first step, reconnaissance. We begin by enumerating the ports using nmap:

```bash
nmap -F -T5 -sVC <ip_victim>
```

* **-F**: Scans the top 100 ports.
* **-T5**: Sets an aggressive scan speed.
* **-sVC**: Runs basic scripts and gathers service information.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcUUQ7YmE39P4XSVON8GbWGEmSvDcSgBNUa2tnWUw_lTE1lMP6_h7wurGd2LACzY965NIcdLAu2tH4ZJRX2Bc-C7GAJ1Zr1eS-GpG18uB3ADP5zLLE6SO77NmI4jHRudf500ywF9w?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

After running the scan, we discover the following:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfaWiRq4CF-oeRW5ZTL_4QN_7ivOHmJrapMk2Z7X-yl4EMj9MfJE7kPIrSxkp9Ns9KF0Fv1LxwkXdJ6rpmcLDsXc4AtkyqLDXlwp4cL-2keO5shQ2uT8M6VXy3FSOt4tNHR56ub-A?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

Ports Open:

* **22** SSH
* **80** HTTP

With this, we have our first three answers.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdQRX8DGSUg6e3Tf9LKbL6ziKubq3hJmJiTMKpo4mBQCnzINMyhmqE98EWb0UkFVBqpru0IXsIa8BO9Ape7ZyLKVfucfZtCMcXSX3OWrSrE37hV58FYUH8OAP4mfm8xOiJdWJJkXA?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

Next, we visit the website at:

```bash
http://<ip_victim>:80
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXd_Ty_3nAcrd6NbgvzahWHN5ZQ0V5lPmjeqClWSM5MsriJwqcIEj18fRIhXSPUn_Q0vKmwIFIqChOnyH8eG9XKiyET8RcPY7ewLfn_SNCVSH5IMO-j0NrCzrcV45wFC_h35S9gWVA?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

It looks like a normal webpage. We reviewed the source code and the `robots.txt` file, but no relevant clues were found.

#### Directory Enumeration

At this point, we proceed with directory enumeration using **dirbuster**.

```bash
dirbuster
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc2N2leWTEQwnxhgXOL1FtxP3p3t98LBWoC2tUYG83hlOo5jozaIkYkToyX99GZdYvhcdv3i3zJKVI-k6PhlY7-Tr39UV9JKkZIbSJSneqb4LUgcL4AtQ4S8Fz9kh0PbHPRbbNM2g?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

After some time, we find the **/panel/** directory, marking the end of the reconnaissance phase.

***

### <mark style="color:purple;">Gaining a Shell</mark>

Knowing about the directory, let's see what's inside.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfLcL1oYEyUaAvccUy1Z4exKqijWzdo40_TUYQVCLi3YnM31PvB2pZxzvF2IRWZOdHww0ceixCnB7xIBF985NdNPNM69Act6sDQVdeM-QEN0ykCzPc2g1ztS-Jd9d9lK3iBuz9U?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

It appears to be a file upload form. Let's try uploading a [PHP reverse shell](https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php).

```bash
sudo vim php_reverse_shell.php
```

Remember to change the values in the <mark style="color:orange;">**//CHANGE THIS**</mark> section to match our setup.

Before uploading, we set up a listener to catch the connection:

```
nc -lnvp 8888
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeeqON5KLebzW0DQQWIymI67PQp6lZv0mE_wpXzYtsJW06f0jl7KHdpL10IsMDKgLF3aaNOvQcDPJQmWMcW_exb_3jOEKKTYgbkZs9_0V_rCXIsyTu7iWAJDif7L-2fL_oUbVIGGQ?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

We attempt to upload the file.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdC-udDH6bTrzzOL4kTNPF4UlWAZU9z3U99sPyM5DVETVREyG8g0HQzxbE3p91AXH_9E6TLpPvVt8_MPtpQj4_7h1w6D_149ivDXsW37VFyzyxmXYtqFT1cLK_MAGz70_054KUM?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

It seems to reject standard PHP extensions. Let's try **.php5**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfePJNa0hd250ChkqxkyWMa5XQrNPDi106Vm0hgJuuyRsquhQx-jRJtlCjvcUqnUTkyfDvFGpdqqmHnbxg1GZhcASwmpFtoXrdNsrlKeXlYXZaQNGuAwfFiE-qFwGqQ8lXH4tgwqg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

It worked! At the bottom, there's a button labeled **"veja!"** to open the file. Let's click it.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfMRLrB_AJLN3PnZwzY95gzHPfngrLMJboQEYY5b96grhaG7bAvb95gJmOpmMRkL0Qb2T7joaCE2ZPWRrIu75rLKHCpJGEMnrRRYHS8qjtrf2fCgIhgVBb8sD29oMfX-PuYZx4l?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

We are connected! Running **`whoami`** confirms we are logged in as **www-data**.

To find the <mark style="color:blue;">**user.txt**</mark> file required in the task, we run:

```
find / -type f -name "*user.txt*" 2>/dev/null
```

* **-type f**: Searches for files.
* **"*****user.txt*****"**: Matches any file containing this string.
* **2>/dev/null**: Suppresses permission errors.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeYlxwrIP9TMOlmTu1Nr_sCpuGuHEh1WmH3oMv3hCd226hcJl7i1iRQSyWTTgVUPfWFxsSeg2UzjlUXkuqi9KXwvdfxmW74dsgrF54zh1Az7FHgbXTNoLU3wXhmMN2v0eeIbCIkjg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

Let's view the contents of **user.txt**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfQeaAQmtXFFyUKoVSWQj0VfEf79NV3wWSGzX3wr37w5J4guUygoM4uMXA7ECsUDLCKOFIbpURH6jmnoKgCQUfoIed6Tt2Kk7KtaD-2dv8huuQc4MZUq0Wh799TeSXLiCIvD-s_?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

With this, we complete the second stage.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeFe5RCDA3JemqcUhjJuSaxV3UycecXNMFwN9JnvgDmToV3hzAOQR4_kqJ4RvH7Xht9nShHwxhKSIBVPJVtC-OpLjyl7SEBWjzYNwFCLGGbhq7i8zfyNs53rC7Hml1ktYPTrwyPPg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

***

### <mark style="color:purple;">Privilege Escalation</mark>

Finally, we need to escalate privileges to root.

First, we check if we can run commands with sudo:

```
sudo -l
```

No luck there. Let's check for SUID files:

```
find / -type f -perm -04000 -ls 2>/dev/null
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcSsOZoKHnRlVDUo2Q20sZJExOBviqbVWUJ-9bJ2Vb_HsFpiXf6hrEwQ5S6toKOAFaCsEBGftPjxv4TQJJ3f4jSDX5GUJSfz2EJK52IB4PKNqrA4sOdHK1vVhHj7p2jKMFPYkahEg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

Among the results, **/usr/bin/python** stands out. Let's check [**GTFOBins**](https://gtfobins.github.io/gtfobins/python/#suid) for potential exploits.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdllv101dbQ7Eo9J89M3QHwULbxD6P935FcAG11EjpDa7u5SkS9TX5STNmwU_HSdDfTPFHtGTKldB4gbwOQ4mH8rrufRX0PcJ7BlXO4oBMNljtCiAPqmzT72wBF2uztUJ19zSjI9Q?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

We find that running the following command should grant root access:

```python
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
```

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeuwFJcLw18u1S_2J4XAG0o4v67ANtJL3SNdmQh6SC0AXG0Iil02roS6DCzKBAJTRilqsK_CG6BPoxKGt6r4tjKrgexuZITAwjG-weNAyrybpqVSMWr0x4cGDNqrTvtY_VS_BFwfg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>

It works! We are now root. The last step is to find and read **root.txt**:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcD5yBMfjVFx5R637GUU601a_1GZ2IzSMgZ05gq-Mr5nHJ4_EqRZxFcYf3jmcgnqCzO0E9KD0FZn31L69gdtvDiiU7PpD9mE-jZLn6qgj87gI3z32uV6TE2cfCgCaAHjm1_LAfNQg?key=6EOe3HPJ5Y1l2nl91es7xFNQ" alt=""><figcaption></figcaption></figure>
