[ 0. Summary ]─────────────────────────────────────────────────────────────//───
CVE-2025-5880 is a really straightforward intermediate difficulty lab on Proving
Grounds. It involves exploiting a vulnerable web application with a path
traversal vulnerability to find secrets.
[ 1. Recon ]───────────────────────────────────────────────────────────────//───
Starting with a lightweight nmap scan to find open ports, we see SSH
(port 22), and an unknown application on port 8899.
We'll ignore SSH for now, and inspect port 8899 in the browser. Doing so, we
find an instance of Whistle, a node.js packet capture proxy tool, and a handy
popup reveals the version number as 2.9.98. It doesn't look to have any
interesting features for us, so let's look for known exploits.
Ah! We've found the namesake vulnerability for our machine! This must be our
path forward. We can verify that it works in Burp by looking for /etc/passwd:
It works! Now we need to work out what exactly we have access to.
[ 2. Access ]─────────────────────────────────────────────────────────────//───
Given the app is designed to capture network traffic, I wouldn't be surprised
if it's running with some enhanced permissions. Let's try and read /etc/shadow,
and assess our privilege level:
Oh, terrific, we appear to have total read access to the filesystem! I tried to
crack the password with Hashcat, but I couldn't get it to identify the hash. I
might be running an outdated version, I should look into updating my tools...
In the meantime, something else caught my attention while reading the contents
of /etc/shadow - the ubuntu user cannot auth with password, but
I know it has a login shell from /etc/passwd. Let's snoop for some SSH keys.
I tried all the usual suspects for ubuntu - /.ssh/id_ed25519, /.ssh/id_rsa,
/.ssh/id_ecdsa to no avail. Since we can read root files, let's just have a nose
in the /root directory as well.
Well that was easy - an RSA key is now in our posession! After a little bit
of formatting and ensuring we set permissions on our local key file, we can
login via SSH as root using the secret we uncovered!
──[ EOF ]──────────────────────────────────────────────────────────────────//───