← Back to Writeups
CUSTOMEasyWeb
Bookmark

Mikroo

XESXOR9/2/20261 min read
#web#custom#easy#capability_abuse#unrestricted_file_upload#vhost_enumeration#webshell_rce

Mikroo

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: capability_abuse, unrestricted_file_upload, vhost_enumeration, webshell_rce

Summary

Walkthrough of the CUSTOM Web Mikroo. Task: an Apache/PHP site exposed a hidden upload vhost and stored uploaded files inside a web-accessible uploads directory. Solution: reuse the available PHP shell for RCE as apache, then abuse perl w

Description

Original task name: «Микроо»

Target: 192.168.2.209

The target was an Apache/PHP site. The goal was to move from web recon to code execution and then escalate locally to recover the root flag.

Analysis

Recon on microo.cdb showed a main vhost that listed files from /uploads. Apache configuration revealed another vhost, upload.microo.cdb, with DocumentRoot /var/www/localhost/htdocs/upload.

The upload application source in /var/www/localhost/htdocs/upload/index.php used move_uploaded_file() with basename() only and had no server-side validation. Uploaded files were placed into /var/www/localhost/htdocs/www/uploads/, which was reachable from the main site. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

An existing shell.php was already present in /uploads and provided command execution through ?cmd=. That immediately gave RCE as user apache.

Local enumeration then showed that /usr/bin/perl had the capability cap_setuid=eip, which was the privilege-escalation path.

Solution

  1. Browse microo.cdb and inspect the /uploads area.
  2. Identify the hidden vhost upload.microo.cdb from Apache configuration.
  3. Review the upload source and confirm unrestricted file upload into the web-accessible uploads directory.
  4. Reuse the existing shell: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍
 text 
http://microo.cdb/uploads/shell.php?cmd=id
  1. Enumerate local privileges and find Perl capabilities.
  2. Read the root flag with:
 bash 
perl -e 'use POSIX qw(setuid); setuid(0); exec q(/bin/sh),q(-c),q(cat /root/flag.txt);'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

  • Mastering capability_abuse, unrestricted_file_upload, vhost_enumeration, webshell_rce was key to this challenge.
  • Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2026-04-04 • CUSTOM • Mikroo • Difficulty: Easy