Lavita: Proving Grounds Linux Walkthrough

Nmap output

Nmap scan report for 192.168.123.38
Host is up (0.059s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u2 (protocol 2.0)
| ssh-hostkey: 
|   3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
|   256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_  256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
| http-methods: 
|_  Supported Methods: GET HEAD OPTIONS
|_http-server-header: Apache/2.4.56 (Debian)
|_http-favicon: Unknown favicon MD5: D41D8CD98F00B204E9800998ECF8427E
|_http-title: W3.CSS Template
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

We have a webpage on port 80

Lavita walkthrough, Got reverse shell as skunk user, screenshot 1 — Lavita, step 1

After directory bruteforcing we found login.php

Lavita walkthrough, Got reverse shell as skunk user, screenshot 2 — Lavita, step 2

There’s register page as well so I registered with test credentials

Lavita walkthrough, Got reverse shell as skunk user, screenshot 3 — Lavita, step 3

Lavita walkthrough, Got reverse shell as skunk user, screenshot 4 — Lavita, step 4

Now when we send post request to / we can access debug page and see the laravel version

Lavita walkthrough, Got reverse shell as skunk user, screenshot 5 — Lavita, step 5

Found exploit for this laravel version which is vulnerable to CVE-2021-3129

Lavita walkthrough, Got reverse shell as skunk user, screenshot 6 — Lavita, step 6

Ran the exploit and got code execution

Lavita walkthrough, Got reverse shell as skunk user, screenshot 7 — Lavita, step 7

Ran the exploit with reverse shell payload

Lavita walkthrough, Got reverse shell as skunk user, screenshot 8 — Lavita, step 8

Got the reverse shell

Lavita walkthrough, Got reverse shell as skunk user, screenshot 9 — Lavita, step 9

Got local.txt (ece566f67c5bb2dce6cc36204761352a)

Lavita walkthrough, Got reverse shell as skunk user, screenshot 10 — Lavita, step 10

We have DB creds in Environment variable

Lavita walkthrough, Got reverse shell as skunk user, screenshot 11 — Lavita, step 11

Lavita walkthrough, Got reverse shell as skunk user, screenshot 12 — Lavita, step 12

Found nothing interesting in DB. So I ran pspy and a cronjob is running

Lavita walkthrough, Got reverse shell as skunk user, screenshot 13 — Lavita, step 13

We see that there’s a custom command in /var/www/html/lavita/app/Console/Commands/ClearCache.php and we have write access to the file

Lavita walkthrough, Got reverse shell as skunk user, screenshot 14 — Lavita, step 14

Modified the file to run reverse shell payload

Got reverse shell as skunk user

We have sudo access to composer

Lavita walkthrough, Got reverse shell as skunk user, screenshot 17 — Lavita, step 17

Using gtfobins for exploit

Lavita walkthrough, Got reverse shell as skunk user, screenshot 18 — Lavita, step 18

From the www-data user shell we rename composer.json to composer.json.bak

Lavita walkthrough, Got reverse shell as skunk user, screenshot 19 — Lavita, step 19

Then we create our own malicious composer.json

Lavita walkthrough, Got reverse shell as skunk user, screenshot 20 — Lavita, step 20

Ran the exploit and got root

Lavita walkthrough, Got reverse shell as skunk user, screenshot 21 — Lavita, step 21

Got proof.txt (c2d643ee8cfcf14da5bc78c1131762b8)

Lavita walkthrough, Got reverse shell as skunk user, screenshot 22 — Lavita, step 22

More walkthroughs

BitForgeLinux

Full walkthrough of the BitForge box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 3306/mysql. Foothold to root using evil-winrm, kerberoasting, linpeas.

CLUELinux

Full walkthrough of the CLUE box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 139/netbios-ssn, 445/netbios-ssn, 3000/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

CockpitLinux

Full walkthrough of the Cockpit box on Offensive Security Proving Grounds (Linux). Enumeration across 22/ssh, 80/http, 9090/http. Foothold to root using evil-winrm, kerberoasting, linpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.