Assertion101

Summary

Starting by enumerating the web service on the target machine, the attacker can identify a potential LFI attack vector, enumerating this feature the attacker can break the code. To achieve injection attacker should try to build a payload that fixed the code while using the input that initially breaks the syntax. Doing so leads to identifying and RCE injection that leads to shell user access on the target.

To achieve root access a SUID executable can be identified and easily exploited with a public POC available.

Lesson learned : to identify injection break the code, to achieve injection fix the code while using the payload that broke it.

Nmap Scan

Enumeration

We have a Fitness website on WEB service (port 80)

hosted on Ubuntu apache server based on wappalyzer output

I still need more information so I go with katana to have a look at URL existing on the web app

this showed me the app is PHP based and index.php file have a parameter “page” which can be used to load other pages -> potential for injection that can lead to LFI (Local File Inclusion) and reading system files.

To make sure I am not missing anything now I go for a web bruteforce attack on the root URI

And then on the page parameter

since the fuzzing on page parameter did not return any .php results it means that the logic in index.php is probably appending .php to the parameter input value so sending “page=about” make index.php load “about.php” if I can bypass that I could probably read other files not ending with .php (at least at the same directory)

Foothold

Trying to inject multipe payload I was able to see a different message when ijecting a single quote and just a dot

the output with “.” hints into a custom filter while the single quote does trigger an error, meaning that it’s breaking the code and if I can fix the break injecting something that means I could make this injection work, so I keep trying with payloads starting with single quote

testing this I found that and|or do not break the syntax when surrounded by single quotes so I try using that to execute some PHP

As showing above this worke to run phpinfo() function in the index page !

Now I can try to get a hit back from this logic running a system command and a python http server

I have confirmation that this is actually a straight RCE and I can use that to get reverse shell

Initial Access

With the identified RCE I just change my payload and start my listener to catch it

and I have local.txt flag like that

Privilege Escalation

Looking at SUID file I identify aria2c that is listed on GTFObins

I was able to use the file download method to overwrite the root user authorized keys

I just had to run that twice to get it to write the proper file

and now I was able to ssh with my id_rsa file as root to the target and get proof.txt flag