Well, there is only one open port. Let's check it out.
"Once you access port 80, you'll see a simple IP address checker page. Try sending a request by clicking the blue button. Eventually, it redirects to ping.php?target=. So, I tried this Command Injection payload: 127.0.0.1; ls worked perfectly, listing files under the www-data user. Now, instead of the ls command, try injecting a reverse shell that connects back to your netcat listener.
The first thing I did was running linpeas.sh script and looked for suspicious things. Then I've found one file called vim.basic which has root access.
You can find it from SUID Files: find / -perm -u=s -type f 2>/dev/null
I looked over the internet about Privilege Escalation Vulnerability in Vim editor and found quite good one here.
I tried the first payload, but it didn't work as expected because Vim intentionally drops root privileges at startup.
To get know more about our vim.basic, I used /usr/bin/vim.basic --help command to get information.
Perfect, it's being compiled by +python3 That means I can escalate to root using Python inside Vim by spawning a root shell via SUID privileges. Use the third c) payload from GTFOBins
What this does:
You now have a real root shell! 🎉 This is how I got so far.
