Patato - OffSec Proving Grounds
Objective
Employ enumeration and web enumeration techniques to identify vulnerabilities. Engage in PHP type juggling for authentication bypass and implement methods for exploiting LFI. Additionally, utilize password cracking and harness privilege escalation strategies along with the abuse of sudo permissions to enhance your access. This lab is designed to capitalize on your skills in vulnerability exploitation.
Enumeration
Nmap
Initial Nmap enumeration revealed open SSH and HTTP ports, along with an unusual FTP port.
WEB Enumeration
Subsequently, Dirb was used to discover an admin login page. Additionally, an admin logs page was found, which disclosed the username ‘admin’.
FTP Anonymous Login
Anonymous FTP login was enabled on the unusual port, allowing access to a backup file named index.php.bak. This file contained the login code with a hardcoded username and password. While the password itself was not known, the logic was vulnerable to PHP type juggling, which was exploited to bypass authentication.
Exploitation
PHP Type Juggling
An explanation of the PHP type juggling vulnerability can be found in the images below.
By applying the type juggling logic—where passing an array to strcmp() results in an error that returns false, which is then treated as 0—we were able to bypass authentication and access the dashboard. Additionally, the user’s password was exposed in plaintext within a cookie.
Path Traversal
Within the admin dashboard, the log page included a file_name parameter that was vulnerable to a path traversal attack. Exploiting this allowed access to sensitive files, such as /etc/passwd.
The target was using md5crypt for password hashing. Using Hashcat, the hash was successfully cracked, revealing the plaintext password.
Next, I accessed the system via SSH and obtained the user flag.
Privilege Escalation
sudo -l
sudo -l revealed that I have permission to run the /bin/nice command within the /notes/* directory.
By leveraging path traversal again, I executed sudo /bin/nice /notes/../bin/bash and successfully obtained root privileges.