Knife
About the machine
Knife is an easy machine involving a PHP backdoored version which allowed me to get access on the system, for the privilege escalation I could run a binary with root permission.
Recon
nmap
Running a simple nmap scan reveals just two ports open, OpenSSH running on port 22 and Apache on port 80.
Based on SSH and Apache banners the host is likely to be running Ubuntu Focal Fossa (20.04).
HTTP
At a first glance accessing the page I thought this would be something related to an Electronic Medical Records system.
After some time analyzing and fuzzing the page and not finding anything interesting I looked into the headers to see if I would find anything useful.
The thing that caught my attention was the PHP version (8.1.0-dev), googling it brought me to a news about a backdoored version of PHP:
Here is the malicious code committed to the repository:
Basically what is doing it is checking the presence of the HTTP header User-Agentt with double t, if it is present and the content starts with zerodium it will evaluate the rest of the statement. So, if it is passed something like zerodiumsystem('id'); it will evaluate to system('id'); .
User
RCE
Just using curl we can test if it is vulnerable or not.
Confirming that in fact it is vulnerable we can try to get a reverse shell.
Root
Enumeration
After getting a shell and running sudo -l I see I can run /usr/bin/knife as root with no password.
Searching for what it is I found it is part of Chef, a platform for DevOps automation.
knife is a command-line tool that provides an interface between a local chef-repo and the Chef Infra Server.
With knife we can do a lot of things including run Ruby scripts with knife exec .
Running the following command I got a shell as root:
Last updated
Was this helpful?