Hacking Dog: Step-by-Step

Outline:

Initial Reconnaissance and Enumeration

Vulnerability Exploitation

Remote Access

Privilege Escalation

Nmap told me port 80 (HTTP) was open and running a web server. Since web services often hide the easiest way in, I decided to focus there rather than brute-forcing SSH or other ports.

Entering this IP address in a browser led me to a website about Dogs (Pretty obvious since the machine is called Dog😅)

To poke around the website automatically, I used dirsearch:

This brute-forces directories and filenames with a big wordlist. Within seconds, it found a .git folder. This was a step in the right direction since Git repositories often leak source code and credentials.

Dirsearch also revealed a couple of accessible directories, one of them was /files, accessing it and looking around led me to a certain username: Tiffany

Not knowing what to do with this now, I filed it away, and perhaps it'll be useful in the future.

Back to the Dog homepage in my browser, I now attempted to log in. This proved to be a bit challenging as default credentials like admin: admin, admin: password, among other default credentials, didn't work.

Remembering the credentials from the settings.php file, I tried root: password-from-settings.php-file, but still, I couldn't gain access.

After multiple attempts, the credentials that worked were:

username: tiffany

password: password-from-settings.php-file

PS: Remember, I got the username 'tiffany' from exploring the /files directory as explained above.

Tip: This successful authentication is a classical example of a critical security principle: credential segregation. When organizations reuse credentials across different systems or fail to implement proper secrets management, the compromise of one system often leads to the compromise of others.

This is commonly reduced by the implementation of privileged access management systems and credential vaulting solutions.

Never Leave .git Files in Production Environment

Exposing Git repositories in production is a critical security vulnerability that violates the principle of least privilege. These repositories contain complete commit histories, which often include:

1. Database credentials and connection strings
2. API keys and authentication tokens
3. Configuration details that reveal system architecture
4. Internal pathways and file structures
5. Evidence of security controls and their implementation

This exposure allows attackers to restore the entire codebase locally and analyze it for vulnerabilities at their leisure, dramatically increasing the attack surface.

In this case, examining the settings.php file revealed database credentials for Backdrop CMS, giving me the first significant foothold in the system.

Backdrop CMS is an enterprise-level content management system designed to provide a framework for building and managing websites. The presence of Backdrop CMS on this system indicated a structured web application with potentially exploitable modules and components.

Once inside the CMS, I looked for a file-upload feature ( in order to upload a PHP code for a reverse shell). This was not possible, so I checked the CMS version under Reports → Status Report. Then I researched for vulnerabilities in the CMS, ideally, one related to remote code execution, and hence gain a reverse shell.

I landed on an Exploit-DB entry by Ahmet Ümit BAYRAM, which was an Authenticated Remote Command Execution script for Backdrop CMS version 1.27.1 (this happens to be the same version of the CMS Dog is using)

Tip: It is important to know the exact version of whatever software you are working with. You can't go around running scripts unless you are sure that the software version in question is vulnerable to whatever you plan on exploiting with your script.

I downloaded it, made it executable, and ran it:

This creates a circular pipeline where commands sent from the attacker are executed on the target with their output returned to the attacker, providing interactive remote shell access with the privileges of the web server user.

Lateral Movement and User Access

After a thorough enumeration of the system, I identified a user account named "johnsucack." Based on the previously observed password patterns, I attempted to switch users using the password that has been working so far (password-from-settings.php-file).

Once authenticated as the johnsucack user, I was able to access the user flag:

Privilege escalation requires careful enumeration of potential vectors. I began by examining the commands this user could execute with elevated privileges using the 'sudo -l' command

The output revealed that the johnsucack user had permission to execute the '/usr/local/bin/bee' binary with root privileges. This binary required further investigation on my end to understand its functionality and potential exploitation vectors.

After analyzing the binary and its execution parameters, I identified that it accepted a root parameter that defined a working directory and an eval parameter that could be used to execute arbitrary code.

I first tested command execution with a basic identification command:

sudo /usr/local/bin/bee --root=/var/www/html eval "system('id');"

The successful execution of this command with root privileges confirms the presence of a privilege escalation vector through this binary. The vulnerability exists because:

1. The sudo configuration allows the johnsucack user to execute this specific binary with root privileges
2. The binary accepts arbitrary code through its eval parameter
3. No input validation or restrictions are in place to prevent the execution of system commands

With the vector confirmed, I proceeded to establish a root shell:

sudo /usr/local/bin/bee --root=/var/www/html eval "system('/bin/bash -p');"

This command follows the same structure as the previous test, but instead executes a privileged bash shell ( -p flag ensures the shell maintains its effective user ID, preventing it from dropping privileges).

This provides a root shell, allowing complete system access.

With root access established, I went to the root directory to obtain the final root flag

Wrap-Up

Dog walked me through a classic CMS-based attack: leak a Git repo, extract credentials, upload a backdoor module, get a reverse shell, then exploit a sudo rule.

Onto the next challenge!