Vulnhub / Web / Curl / Cron
Another fun machine. Here we utilize the Curl command to inject a shell. From there, you privesc off of a vulnerable application running from Cron.
Using curl we can see our server allowed options. Look at the “Allow: PUT” option. This allows us to place & PUT content onto the server.
curl -v -X OPTIONS IP/Options_Folder
Below we sampled the command to see if it worked. We successfully placed a shell with php system call commands.
Take note of the IP to ensure you change the shell to point to your IP for call back.
After obtaining a shell enumerate the system privilege escalation points. You can use G0tm1lk’s guide found here: https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
We now use printf to place a one-liner into the update file which we’ll call by Cron according to EDB @ https://www.exploit-db.com/exploits/33899
