Extra Notes

Snare

Executive Summary

A penetration test was conducted on the target machine 10.115.0.150.18 (hostname: snare.ptd). The assessment revealed critical vulnerabilities, including Remote File Inclusion (RFI) leading to initial access and misconfigured file permissions on /etc/shadow, allowing privilege escalation to root.

Key Findings:

  • Remote File Inclusion (RFI) in index.php leading to code execution.

  • World-writable /etc/shadow allowing root privilege escalation.

  • Exposed sensitive credentials (password hash modification possible).

Risk Level:

  • Critical (Unauthenticated RCE + Privilege Escalation to root).

Methodology

Reconnaissance

Nmap Scan Result

Open Ports:

  • 22/tcp (SSH) – OpenSSH 8.2p1 (Ubuntu)

  • 80/tcp (HTTP) – Apache 2.4.41 (Ubuntu)

Enumeration

Web Application Analysis:

URL structure: http://10.115.0.150.18/index.php?page=home

Suspected Local/Remote File Inclusion (LFI/RFI) vulnerability.

Exploitation

1. Remote File Inclusion (RFI) → RCE

At the first glance the url build like /index.php?page=home, this indicate potential Local File Inclusion or Remote File Inclusion.

Reverse Shell Obtained:

Gained access as www-data.

Stabilized shell:

Privilege Escalation (Root via /etc/shadow Modification)

Manual enumaration find that, /etc/shadow can be edit by global user. With the persmission, we can change root hash with crafted one. I will use mkpasswd with password smallcurl.

Discovery:

/etc/shadow had world-writable permissions:

Exploitation:

Generated a new root password hash (smallcurl):

Replaced root’s hash in /etc/shadow.

Logged in as root via SSH or change user (su)

Findings & Vulnerabilities

1. Remote File Inclusion (RFI)

  • Risk: Critical

  • Description: The page parameter in index.php allows arbitrary file inclusion, leading to remote code execution (RCE).

  • Proof of Concept (PoC):

  • Impact:

    • Unauthenticated attackers can execute arbitrary commands as www-data.

2. World-Writable /etc/shadow

  • Risk: Critical

  • Description: The /etc/shadow file had 777 permissions, allowing any user to modify passwords.

  • Impact:

    • Any low-privileged user can escalate to root by replacing the root hash.

Recommendations

Remote File Inclusion (RFI)

  • Sanitize user input in index.php.

  • Use a whitelist approach for file inclusion.

  • Disable remote URL inclusion in PHP (allow_url_include=Off).

/etc/shadow Permission Misconfiguration

  • Restrict /etc/shadow permissions:

  • Audit system-critical files for incorrect permissions.

Conclusion

The target machine was fully compromised due to Remote File Inclusion (RFI) and misconfigured /etc/shadow permissions. Immediate remediation is required to prevent unauthorized root access.

Next Steps:

  • Patch the RFI vulnerability.

  • Correct /etc/shadow permissions.

  • Conduct a full system audit for similar misconfigurations.

Report Author: whymir Date: 28/3/2025

Last updated