HTB Linux Easy: Knife

Nmap scan

Initial Foothold

Enumerate HTTP (Port 80)

Nothing interesting found while dirbusting, enumerating the page, etc. We do know that PHP is running on the server, we can determine the version using curl.

Gain shell

Run the Python exploit (it will use the host User-Agent header to execute a reverse shell).

Our nc listener will have turned into a shell.

Priv Esc

Sudo -l reveals a program that we can execute as root.

Following the command on GTFOBins results in a root shell.

User.txt

Root.txt

You have PWNED

Sources

• Find PHP version
• PHP exploit
• Knife Priv-Esc