Toppo is a boot2root aimed at beginners.  You can download it from vulnhub here.

Scanning

First step is to find our target’s IP address. We’ll accomplish this via arp-scan

Our target is located at 10.10.10.22. The next step is to determine what ports are open, using nmap.

Port :22

OpenSSH 6.7p1 is running on port 22.  Our nmap scan also tells us that it is likely a Debian version.

Port :80

Apache httpd 2.4.10 is running on port 8.  Nmap states that it is likely a Debian version as well, again indicating that the target is likely a Debian box.

Vulnerability Analysis

SSH

A quick scan of searchsploit doesn’t return any exploits for our version of OpenSSH.  In theory, we could still try to brute force our way in, but without even knowing a username, this is unlikely to succeed.

HTTP

There don’t appear to be any useful exploits for our version of Apache, time to take a look at the website that is running.

It appears to be a Bootstrap CMS site.  This is my first time encountering them, and after a quick Google search, it doesn’t appear like there are any standard login portals like you might have with a WordPress site (wp-admin).  Nothing yielded by searchsploit either.  There’s also no robots.txt file!

Next step, nikto.

/admin/ is indeed interesting.  It has directory indexing, meaning you can view all of the files located at that directory.  It contains one file titled notes.txt

Opening that file yields a lovely little note to self, with what appears to be a password!

At this point I spent a lot of time searching again for some sort of login page for management of the website, but had no luck.  That’s when I remembered that SSH is accessible.  It couldn’t be that easy…

Exploitation

SSH Login

Taking a guess that if the user’s password is 12345ted123, then maybe his username is ted, I tried to log in via SSH.

Reconnaissance

Sudo

It’s been simple enough so far, maybe ted is able to execute commands with sudo?  Let’s check:

So sudo isn’t even available… interesting.

SUID

The suid bit in linux file permissions basically allows a user to execute a command as the owner of that file, rather than as your current user.  An example of this would be the passwd command.  Passwd modifies system files like /etc/passwd and /etc/shadow, something that requires root privileges.  That means that in order for a user to change their password, they need to be able to execute passwd as root.  Sometimes, files will have the suid bit set that can allow you to execute arbitrary commands, serving as a great privilege escalation vector.  For this reason, let’s search for files with SUID bit set, and see if there’s anything interesting.

The command that we will use is below:

The +4000 will search for files with SUID set, -user root only shows those owned by root.  If we are trying to escalate our privileges, we aren’t currently interested in running commands as users other than root. -type f will only return files, and not directories.  -print will output the entire path of matches, instead of just the file name.  And finally, 2>/dev/null redirects stderr to the bit bucket so we don’t have to see any errors about not having permission to search various folders.

The results are below:

There are two items that stand out, python and mawk.  Both of these are interpreters that can execute python and awk code, respectively.

Vulnerability Analysis

Python

Python can execute linux commands in a number of ways.  My method of choice is via pty.spawn, as shown below:

The above lines will open a new sh shell. In order to execute that python code from the terminal, taking advantage of our suid bit on /usr/bin/python2.7, we’d execute the following:

Mawk

I believe that there are a number of ways that mawk could execute linux commands, the only one that I am familiar with is below:

Exploitation

Both of the above two vulnerabilities should be usable to escalate to root privileges.  We’ll next test each of them

Python

Without unispace fonts, it doesn’t turn out well, but that is supposed to say Toppo…

Mawk

And there you have it, root!  And two different ways!  I recommend filing that suid search one-liner for future use, it can be extremely helpful if you’re stuck looking for priv esc vectors.