In this blog, I’ll walk through how a single exposed IPMI/BMC interface let me take full control of a physical server — and how that server turned out to be a Proxmox hypervisor, handing me every virtual machine and container running on top of it, along with the backups behind them. Prologue “A bug is never just a mistake. It represents something bigger. An error of thought that makes you who you are.” — Elliot Alderson, Mr. Robot ...
In this blog, I’ll walk through how I escalated my privileges from a low-privileged user to root on a remote server by abusing an insecurely configured NFS export (no_root_squash). Prologue “Control is an illusion.” — Mr. Robot NFS has a habit of trusting whoever knocks on the door — and trust, as always, is the real vulnerability. Initial Foothold At this stage I already had a shell as a regular, low-privileged user. The interesting part began while I was looking for a way up to root. ...
In this blog, I will demonstrate how a simple directory listing vulnerability led to full system compromise during a penetration test. Prologue “The best exploits are the ones that never feel like exploits at all.” — Mr. Robot I discovered that a web server was exposing its directory contents. Several configuration and compressed files were visible, indicating possible sensitive information leakage. Source Code Analysis After downloading and analyzing the exposed files, I found a PHP configuration file containing PostgreSQL database credentials. ...
Finding the vulnerability During routine exploration of vulnerable servers, I discovered the presence of CVE-2017-9841 on a target domain using Nuclei with the http/cves/2017/CVE-2017-9841.yaml template. The scanner flagged an exposed PHPUnit utility script under the /vendor tree. What CVE-2017-9841 is Util/PHP/eval-stdin.php in PHPUnit (before 4.8.28 and 5.x before 5.6.3) allows remote attackers to execute arbitrary PHP code sent in an HTTP POST body beginning with <?php . This is usually exposed when an application leaves its vendor folder web-accessible, so the eval-stdin.php file can be requested directly. Knowing this enabled me to submit PHP payloads via the POST body to the vulnerable endpoint. ...
Initial Entry Point During a routine exploration of vulnerable servers on the internet, I successfully gained root access to several machines. While the specific method used to achieve root access is beyond the scope of this blog, I’ll focus on how I expanded my access to other servers within the same organization. Extracting Linux User Hashes Once inside the compromised machine, I noticed multiple user accounts. With root privileges, I accessed the /etc/shadow file, which stores password hashes for all users on the system. I copied the contents of the shadow file to my local machine and extracted the hashes using the following command: ...