dreadnaught- Machine
- Bashed
- OS
- Linux
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
A leftover phpbash web shell gives code execution as www-data; a sudo rule and a root cron lead to root.
How it went
- 0nmap
An nmap scan shows a single web server on port 80.
- 1phpbash.php
Nikto reveals /dev/ which contains phpbash.php. Calling it gives us command execution as www-data, the user flag, and the ability to call a revshell.
- 2scriptmanager
Sudo config enables lateral movement to scriptmanager account.
- 3root cron
scriptmanager owns /scripts which contains test.py which is ran via root cron (implicated by test.txt stats). Replace test.py with a revshell for root.