Mikroo

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-04 | Status: Solved Techniques: capability_abuse, unrestricted_file_upload, vhost_enumeration, webshell_rce

Summary

Task: an Apache/PHP site exposed a hidden upload vhost and stored uploaded files inside a web-accessible uploads directory. Solution: reuse the available PHP shell for RCE as apache, then abuse perl with cap_setuid to read /root/flag.txt as root.

Mikroo — Hackerlab

Description

Original task name: «Микроо»

Target: 192.168.2.209

The target was an Apache/PHP site. The goal was to move from web recon to code execution and then escalate locally to recover the root flag.

Analysis

Recon on microo.cdb showed a main vhost that listed files from /uploads. Apache configuration revealed another vhost, upload.microo.cdb, with DocumentRoot /var/www/localhost/htdocs/upload.

The upload application source in /var/www/localhost/htdocs/upload/index.php used move_uploaded_file() with basename() only and had no server-side validation. Uploaded files were placed into /var/www/localhost/htdocs/www/uploads/, which was reachable from the main site. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

An existing shell.php was already present in /uploads and provided command execution through ?cmd=. That immediately gave RCE as user apache.

Local enumeration then showed that /usr/bin/perl had the capability cap_setuid=eip, which was the privilege-escalation path.

Solution

1. Browse microo.cdb and inspect the /uploads area.
2. Identify the hidden vhost upload.microo.cdb from Apache configuration.
3. Review the upload source and confirm unrestricted file upload into the web-accessible uploads directory.
4. Reuse the existing shell: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text read-only • copy allowed Copy
http://microo.cdb/uploads/shell.php?cmd=id

1. Enumerate local privileges and find Perl capabilities.
2. Read the root flag with:

 bash read-only • copy allowed Copy
perl -e 'use POSIX qw(setuid); setuid(0); exec q(/bin/sh),q(-c),q(cat /root/flag.txt);'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍