Law - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SSH, HTTP ports were open.
Web ENumeration
The website was htmLawed 1.2.5 website.
Exploitation
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
The website was vulnerable to RCE but I could not run processing on the website. When I click process button it showed Not Found.
Then I found this blog which explains the exploit in detail.
I tried again with /vendor/htmlawed/htmlawed/htmLawedTest.php or different combinations but still got NOT FOUND errors.
Later I tried fuzzing and found index.php (which was the default page we see).
And I tried to send POST request to index.php instead of htmLawedTest.php and it worked.
Later, I tried bash reverse shell but it did not work. So I downloaded a netcat binary form H74N/netcat-binaries repo and transfered it using wget. Later I gave it permissions with chmod 777 nc. And finally I ran it and got a reverse shell.
Then simply read the local flag in /var/www folder.
Privilege Escalation
cronjob
Inside the /var/www folder there was a file named cleanup.sh which was owned by us (www-data). We could read and write, however we could not run the operations in the file.
pspy64
I ran pspy64 and made sure that root was running a cronjob to execute cleanup.sh
So I updated the script and added nc execution at the end.
After a minute I got the root shell.