Ha-Natraj - LFI Log Poisoning + Apache2 User Hijack + sudo nmap to Root | OffSec PG Play

The walkthrough and analysis provided for the "Ubuntu 20.04 LAMP Stack" machine on Hack The Box (HTB) is comprehensive, covering various vulnerabilities leading to privilege escalation from user to root. Below are key points summarized with actionable mitigation strategies:

Vulnerability Summary

1. Local File Inclusion in file.php

   • Impact: Arbitrary file read and execution.
   • Mitigation:
     • Use strict allowlists for file inclusion.
     • Disable PHP stream wrappers (allow_url_fopen = Off).
     • Set open_basedir to restrict directory access.
     • Remove unnecessary files like file.php.

2. Auth Log Poisonable via SSH Username Injection

   • Impact: Code execution through log poisoning and LFI.
   • Mitigation:
     • Restrict permissions on /var/log/auth.log.
     • Use file_get_contents() instead of include().
     • Send logs to a remote server.

3. Apache Directory Listing Enabled

   • Impact: Exposure of PHP files like file.php.
   • Mitigation:
     • Disable directory listing (Options -Indexes).
     • Remove development/testing

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.