lockdown

overview

this medium-difficulty box demonstrates sql injection to access an admin panel, uploading a reverse shell for initial access, and privilege escalation through clamav custom yara rules.

reconnaissance

initial nmap scan reveals ssh on port 22 and http on port 80:

nmap -v -sV -sC -oA nmap lockdown.thm

key findings:

• ssh: openssh 7.6p1
• http: apache 2.4.29 running a "coronavirus contact tracer" application

sql injection & admin access

the application presents an admin login panel. standard sql injection payloads work:

Username: ' or 1=1 -- -
Password: (anything)

this bypasses authentication and grants access to the admin panel.

web shell upload

within the admin panel at /admin/?page=system_info, there's an unrestricted file upload for a logo image. uploading a php reverse shell provides code execution. the shell executes when logging out and visiting the main site, which loads the logo.

user enumeration

examining /var/www/html/config.php leads to /classes/DBConnection.php, which contains database credentials:

User: cts
Database: cts_db

accessing the mysql database and querying the users table reveals an md5 password hash. after cracking it:

cyrus : [cracked_password]

ssh access is established by importing an ssh key to the user's authorized_keys.

privilege escalation

the user can execute scan.sh as root via sudo. the script uses clamav's clamscan utility. clamav supports custom yara rules stored in /var/lib/clamav, which is writable by the user.

a custom yara rule is created to match arbitrary strings and quarantine files:

rule test {
  strings:
    $show = "root"
  condition:
    $show
}

running the root-level scan against /etc/shadow copies the file to a readable quarantine directory. the extracted hash for user maxine is cracked:

maxine : [cracked_password]

the maxine user has unrestricted sudo privileges, allowing immediate root access:

sudo su

root access achieved.