FunboxEasyEnum

Enjoy FunboxEasyEnum!

Starting with an nmap scan

looking at the http server at port 80 & we have a default apache webserver, now we can fuzz for hidden directories here

We have quite some results back, after manual inpection mini.php stands out.

Visiting the mini.php we find a mini shell/ upload feature, we can abuse it & try to upload a reverse shell

Uploading a php webshell worked, i tried to connect back to shell on terminal with a php reverse shell

Now i can read local.txt

Now unto privilegde escalation

Visiting the /home directory & we can find couple of users (4)

We can try to brute force each user for ssh login since we have an open ssh port 22 from our earlier nmap scan, which i did

We have creds for goat user now, we can use creds to login ssh now

We can enumerate everything for Priviledge Escalation vectors, doing that i find out that goat user can run “/usr/bin/mysql” as sudo

Gtfobins to the rescue

Running sudo mysql -e ‘! /bin/sh’ gives us a root shell and we are root!

###RESOURCES

https://portal.offensive-security.com/proving-grounds/play

https://gtfobins.github.io/gtfobins/mysql/#sudo

https://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php