Samurai
Challenge Lab (Easy) - by Streetcoder
The following post by 0xb0b is licensed under CC BY 4.0
Scenario
Objective
As part of a penetration test, your team identified an interesting web server. Your task is to enumerate the target, establish an initial foothold, and escalate privileges to root.
Initial Access
You have been provisioned VPN access to the client environment. No initial credentials are provided.
Summary
Summary
In Samurai, we begin with external enumeration and discover a web server on port 80 alongside SSH on port 22, then use directory brute forcing to uncover a Joomla administrator panel at /administrator. Fingerprinting the CMS reveals version 4.2.5, which is vulnerable to CVE-2023-23752, allowing unauthenticated access to sensitive API endpoints. Exploiting this flaw, we extract valid credentials for the user Miyamoto and successfully authenticate into the Joomla admin panel. From there, we abuse template editing functionality to inject a PHP web shell, gaining a reverse shell as www-data.
For privilege escalation, we identify a SUID backup utility /opt/backup/DbMaria that wraps mariadb-dump with root privileges. Static analysis of the binary reveals unsafe command construction, enabling command injection via crafted arguments to spawn a root shell using bash -p. As an alternative path, we also identify a PATH hijacking opportunity by exploiting the relative mariadb-dump call, allowing us to place a malicious binary earlier in the execution path and trigger SUID execution.
Recon
We use rustscan -b 500 -a samurai.hsm --top -- -sC -sV -Pn to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts -sC, service and version detection -sV, and treats the host as online without ICMP echo -Pn.
A batch size of 500 trades speed for stability, the default 1500 balances both, while much larger sizes increase throughput but risk missed responses and instability.
We identify a web server running on port 80, along with an SSH service exposed on port 22.
We first visit the site using our browser, but at first glance, we can only see a static web page. We proceed with a directory scan.
By running a directory scan with Feroxbuster, we can identify some interesting directories. In particular, /administrator/.
We visit the admin page and see the Joomla login screen. So we are dealing with the Joomla CMS.
Next, we'll use Joomscan to identify the version, publicly available information, and potential vulnerabilities. We are dealing with version 4.2.5.
Access as Miyamoto
After some research, we also find a vulnerability related to this version: CVE-2023-23752
CVE-2023-23752 is an improper access control flaw in Joomla 4.0.0–4.2.7 that allows unauthenticated users to access restricted webservice endpoints and leak sensitive configuration data:
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
We can use the following explpoit from exploit-db.
We run the exploit and identify the user Miyamoto and a DB password.
Next, we head back to the log in page and try those credentials found.
We are able to log in and with that we have administrator privileges.
Shell as www-data
This allows us to place a reverse or web shell in one of the templates. We use the following guide:
First we head to System->Templates->Administrator Templates.
There we select a template we want to edit and open the index page. There we place the following web shell.
We can call it like the following.
Next, we prepare a listener for our reverse shell.
We issue a reverse shell (logged in as Miyamoto) using busybox...
... and receive a connection. We are www-data and find the user flag at /var/www/user.txt.
Shell as root
As www-data we are allow to run the /opt/backup/DbMaria as root using sudo.
Next, we analyzed the executable in more detail. We begin with strings to extract readable character sequences and gain insight into its functionality. If this proved insufficient, the next step would be to decompile the binary using Ghidra or Binary Ninja.
via Command Injection
Here we can see the following line:
We assume, that the line is executed via system(). We try to abuse this by injecting a simple command that spawns bash with the -p flag, allowing it to preserve the effective privileges of the owner and potentially grant us a root shell.
A root shell is spawned and we find the final flag at /root/root.txt.
via PATH Hijacking
We can see that the mariadb-dump application is not called using an absolute path, but a relative one. The idea is to modify the environment variable so that the system first checks a directory for the executable that contains a malicious one.
We create a malicious mariadb-dump executable in /tmp/mariadb-dump and make it executable.
Unfortunatley we can perform a PATH Hijack using sudo because of the set secure path option
(sudo -l) that can't be manipulated:
But since it is a SUID binary, sudo is not required.
We create an example file to import
Manipulate the PATH variable so it also includes the /tmp directory.
Next, we run the executable /opt/backup/DbMaria and see a SUID bash binary created in /tmp.
We run it and get a root shell:
Last updated