Milnet v1 challenge

Hello all,
Looking for our target and scanning

Lighttpd 1.4.35 is probably free of known exploits. Let's browse the web application

 







Something interesting? For me - no. I clicked on each links and there is nothing special.
Dirb

That is juicy information! I examined info.php file and I suspect that our target is vulnerable to RFI. I noticed that (using Burp Suite Free) while sending request to the target POST request contains route parameter. I verified that there is LFI, but RFI would be more helpful for us, because if RFI occurs in the web application then we are able to use prepared script to execute via vulnerable web application.
I edited route parameter as follow

route=http://www.google.com/?

and I have got response

So I have verified that route parameter is vulnerable to RFI. Let's create our reverse shell script on our machine and execute it using route parameter.

 We have obtained limited shell! I have found in the /home directory langman subdirectory. This findings indicate that the system has langman user. There are several files.

The /backup/backup.sh looks interesting, let's check privilege the file.

Excellent! Root privileges!
TBU