Writeup by wook413

ReconNmapInitial AccessHTTP 80Shell as www-dataShell as root

Recon

Nmap

As per my standard methodology, I began the engagement with a three-stage Nmap scan: first, a full 65,535 TCP port sweep to identify open ports; second, a targeted service enumeration for version details; and finally, a UDP scan of the top 10 ports.

Initial Access

HTTP 80

The Nmap results indicated that only ports 22 and 80 were open. Before diving into the HTTP service on port 80, I ran the http-enum Nmap script to identify potential “quick wins” or hidden directories.

Upon accessing the target IP via a web browser, I observed a redirection to the exfiltrated.offsec domain. To resolve this, I mapped the target IP to the domain in my /etc/hosts file.

image-20260209213624909

The robots.txt file was found to contain several interesting directories.

I attempted to log in at the /login page using the default credentials admin:admin , which successfully granted me access.

image-20260209213633219

logged in as Administrator

image-20260209213646049

After authenticating, I confirmed through the /panel dashboard that the service was running Subrion CMS version 4.2.1

image-20260209213653907

A search for “Subrion 4.2.1” on Searchsploit revealed both XSS and Arbitrary File Upload vulnerabilities. While XSS is a significant finding in real-world pentesting, I prioritized the file upload vulnerability as it is more effective in a CTF environment.

I downloaded the Arbitrary File Upload exploit script and provided the valid credentials, but the script initially failed with a “Login Failed” message.

Upon reviewing the exploit’s source code, I discovered that it bypassed security filters by changing the payloads’ extension to .phar .

image-20260209213714061

Navigating to the Content → Uploads tab, I manually uploaded a simple one-line PHP payload named shell.phar .

image-20260209213720158

After verifying its execution, I uploaded a more robust Pentest Monkey PHP reverse shell, also renamed with a .phar extension.

image-20260209213730849

image-20260209213735803

Shell as www-data

To ensure a stable and interactive session, I set up a listener using penelope and successfully received a reverse shell connection.

Acting as the www-data user, I began manual enumeration of the system.

I discovered MySQL credentials within the config.inc.php file located in /var/www/html/subrion/includes .

I successfully authenticated to MySQL using the discovered credentials and retrieved the admin user’s password hash. However, since the hash did not appear to be in the rockyou.txt wordlist, I halted the cracking attempt and continued my enumeration.

In the /opt directory, I found a suspicious script named image-exif.sh . This script was designed to process JPG files in the /var/www/html/subrion/uploads directory using exiftool and log the output to /opt/metadata

The installed version of exiftool was 11.88, which is a known vulnerable version.

I found a Remote Code Execution exploit in the Exploit Database. This script automates the creation of a malicious JPG file embedded with a payload designed for this vulnerable version.

image-20260209213749689

This exploit requires djvulibre-bin to be installed to proerly craft the metadata.

image-20260209213754204

Although the original exploit often defaults to a reverse shell, I observed stability issues with that approach in this environment. Therefore, I modified the payload to execute a command that sets the SUID bit on the /bin/bash binary (chmod +s /bin/bash) instead. This ensured a more reliable path to privilege escalation.

I uploaded the malicious image.jpg to the same uploads directory used for the initial access.

image-20260209213802315

After a short wait for the script to execute, I confirmed that the SUID bit was successfully applied to /bin/bash .

Shell as root

Finally, I executed /bin/bash -p to obtain a root shell.

Found proof.txt

Found local.txt