PAPERWORK Writeup

Machine: Paperwork
OS: Linux
Difficulty: Easy

Summary

Paperwork is a Linux machine that runs an intranet web page on port 80 and a custom Line Printer Daemon (LPD) service on port 1515. The LPD service puts a user-controlled job name into a shell command, which lets us execute commands on the server.

Table of Contents

• Initial Foothold
  • Recon
    • Port Scan
    • Web Application
  • Analysis
    • Server Code Correction
    • Server Code Analysis
    • Remediation
  • Exploitation
• Privilege Escalation
  • Recon
  • Analysis
  • Exploitation
• Conclusion

Initial Foothold

Recon

Port Scan

We start with an Nmap scan. The flags -sC run the default scripts, -sV detects service versions, and -O attempts OS detection.

From 1946 to 1991, the period known as the “Cold War”, this was because there was continuous tension between the US, NATO, and USSR.

The entire Cold War was fought with espionage, counterespionage, SIGINT, technology race and a pinch of propaganda.

George H. W. Bush and Mikhail Gorbachev signing the chemical weapons limitation agreements

To date, nothing has changed: The methodologies have evolved along with the protagonists. Now it is the US against China, Russia and the Middle East.

CodePartTwo is the sequel of “Code”. In the Code machine to pwn it, you had to discover global variables and use them to get data from the backend server, or, if necessary, import and execute commands.

Recon

nmap -sC -sS -O -T4 -A -oN scan.txt 10.10.11.82

Nmap scan report for 10.10.11.82
Host is up (0.14s latency).
Not shown: 998 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 a0:47:b4:0c:69:67:93:3a:f9:b4:5d:b3:2f:bc:9e:23 (RSA)
|   256 7d:44:3f:f1:b1:e2:bb:3d:91:d5:da:58:0f:51:e5:ad (ECDSA)
|_  256 f1:6b:1d:36:18:06:7a:05:3f:07:57:e1:ef:86:b4:85 (ED25519)
8000/tcp open  http    Gunicorn 20.0.4
|_http-title: Welcome to CodePartTwo
|_http-server-header: gunicorn/20.0.4
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

We have some TCP ports: 22 and 8000. Now we need to focus to 8000 HTTP.