Offensive Security Proving Grounds Walk Through “WebCal”

Initial Foothold:

Beginning the initial nmap enumeration.

Running the default nmap scripts.

Gobuster enumeration on the web service.

We see an instance of webcalendar running on /webcalendar. Running gobuster to further enumerate this dir.

Many of these go to login.php. The default credentials don’t work though. Upon searching I found an exploit which gives remote code execution. Works perfectly.

PHP compiler is installed on the box. Using it to get a proper reverse shell.

Privilege Escalation:

Running linpeas to enumerate further. I don’t see anything very interesting. The kernel version however matches with few of the privel exploits such as dirtycow and mempodipper.

The dirtycow exploit doesn’t work somehow. Memodipper exploit works giving us root access. Refer: https://git.zx2c4.com/CVE-2012-0056/