Codo: Proving Grounds Linux Walkthrough

Nmap output

Nmap scan report for 192.168.167.23
Host is up (0.058s latency).
Not shown: 65533 filtered tcp ports (no-response)
Bug in http-generator: no string output.
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 62:36:1a:5c:d3:e3:7b:e1:70:f8:a3:b3:1c:4c:24:38 (RSA)
|   256 ee:25:fc:23:66:05:c0:c1:ec:47:c6:bb:00:c7:4f:53 (ECDSA)
|_  256 83:5c:51:ac:32:e5:3a:21:7c:f6:c2:cd:93:68:58:d8 (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: All topics | CODOLOGIC
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have webpage on port 80

Codo walkthrough, Got reverse shell using the shell.php, screenshot 1 — Codo, step 1

After seeing the codologic as title I searched for any known exploit for it on google and found a exploit which is an authenticated exploit and it needs admin creds

Codo walkthrough, Got reverse shell using the shell.php, screenshot 2 — Codo, step 2

Found a admin directory

Codo walkthrough, Got reverse shell using the shell.php, screenshot 3 — Codo, step 3

Tried username & password as admin

Codo walkthrough, Got reverse shell using the shell.php, screenshot 4 — Codo, step 4

& we got in and have admin access

Codo walkthrough, Got reverse shell using the shell.php, screenshot 5 — Codo, step 5

Cloned the exploit and ran the help option

Codo walkthrough, Got reverse shell using the shell.php, screenshot 6 — Codo, step 6

We got this error while running the exploit

Codo walkthrough, Got reverse shell using the shell.php, screenshot 7 — Codo, step 7

Modified script to not use proxy

Codo walkthrough, Got reverse shell using the shell.php, screenshot 8 — Codo, step 8

Still wasn’t working & told to try manually

Codo walkthrough, Got reverse shell using the shell.php, screenshot 9 — Codo, step 9

So I uploaded the shell.php in forum logo

Codo walkthrough, Got reverse shell using the shell.php, screenshot 10 — Codo, step 10

Got command execution using the file we uploaded

Got reverse shell using the shell.php

Ran linpeas and found password in config.php file

Codo walkthrough, Got reverse shell using the shell.php, screenshot 13 — Codo, step 13

Used password to switch user to root and it worked

Codo walkthrough, Got reverse shell using the shell.php, screenshot 14 — Codo, step 14

Got proof.txt (e767b37ce2813136b8be2d8649e23b3d)

Codo walkthrough, Got reverse shell using the shell.php, screenshot 15 — Codo, step 15

More walkthroughs

BitForgeLinux

Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.