Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
This lab involves comprehensive enumeration techniques, including network and web application enumeration, to gather insights about the target system. Learners will exploit CVE-2022-40048 to gain initial access and then focus on privilege escalation methods. By abusing sudo permissions, users will learn effective strategies for gaining elevated access on compromised systems. This lab emphasizes the importance of enumeration and vulnerability exploitation in penetration testing.
Scenario
This lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in FlatPress v1.2.1 (CVE-2022-40048) through the file upload functionality. Privilege escalation is achieved by leveraging a misconfigured sudo permission for the apt-get command to execute arbitrary code as root. This lab highlights default credentials exploitation, file upload RCE, and privilege escalation using sudo misconfigurations.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify FlatPress running on the target server.
- Log into FlatPress using default credentials (admin:password) and access the uploader feature.
- Upload a malicious PHP file containing a reverse shell payload.
- Trigger the uploaded file through the Media Manager to establish a reverse shell as www-data.
- Exploit the sudo permission for /usr/bin/apt-get to escalate privileges and gain root access.
Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
| 3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
| 256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_ 256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open http Apache httpd 2.4.56 ((Debian))
|_http-title: Lugx Gaming Shop HTML5 Template
|_http-server-header: Apache/2.4.56 (Debian)
8089/tcp open http Apache httpd 2.4.56 ((Debian))
|_http-generator: FlatPress fp-1.2.1
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: FlatPress
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.