◈ blackpearl.mddotrobin.dev / workbench

Blackpearl — Penetration Testing Report

Result: Root access achieved

I compromised Blackpearl by exploiting Navigate CMS 2.8, obtaining a www-data shell, and escalating privileges through a root-owned SUID PHP interpreter.

Attack path: DNS enumeration → Web content discovery → Navigate CMS RCE → www-data → Local enumeration → SUID PHP → Root

Target environment

Target: Blackpearl, 192.168.18.10
Hostname: blackpearl.tcm
Attacking machine: Kali Linux, 192.168.18.4
Operating system: Linux
Web server: Nginx 1.14.2
Application: Navigate CMS 2.8

1. DNS enumeration and hostname resolution

I used DNSRecon to enumerate the target and identify blackpearl.tcm. I added its IP-to-hostname mapping to /etc/hosts on Kali and my Mac, enabling access through the application’s hostname.

I verified hostname resolution with getent and checked HTTP connectivity with curl. The server responded with HTTP 200 OK and identified itself as Nginx 1.14.2.

2. Web content discovery

I used FFUF with the directory-list-2.3-medium wordlist to discover exposed web content. Numerous requests returned identical 652-byte responses, so I filtered that response size to reduce false positives.

I identified /secret and discovered /navigate during further enumeration. The /navigate directory exposed Navigate CMS 2.8, which became my initial-access target.

3. Vulnerability research

I researched Navigate CMS 2.8 and identified a Metasploit module that exploited authentication bypass and file-upload weaknesses to execute PHP code remotely.

I selected the Navigate CMS RCE module, reviewed its options, and configured the target:

Target address: 192.168.18.10
Virtual host: blackpearl.tcm
Application path: /navigate/
Callback address: 192.168.18.4

4. Initial access

I executed the exploit and obtained a shell through the vulnerable CMS. I ran whoami and confirmed that the session operated as www-data.

This established remote command execution under the web-server account, but I still needed to identify a local privilege-escalation path.

5. Shell stabilization and local enumeration

I used Python’s pty module to spawn an interactive Bash shell and improve terminal functionality.

I inspected my user identity, group memberships, sudo permissions, and shell history. These checks did not reveal a useful escalation path, so I continued with broader local enumeration.

6. LinPEAS enumeration

I hosted LinPEAS from Kali using Python’s HTTP server on port 8000, transferred the script to /tmp on Blackpearl, made it executable, and ran it.

I reviewed the results for privileged executables, writable paths, scheduled tasks, and configuration weaknesses. The enumeration identified PHP 7.3 as a potential privilege-escalation vector.

7. SUID PHP investigation

I enumerated SUID binaries and inspected /usr/bin/php7.3. I identified the root-owned PHP interpreter as an executable that could run with elevated effective privileges.

I consulted GTFOBins and identified a technique using PHP’s pcntl_exec() function to launch a shell while retaining those privileges.

8. Privilege escalation

My initial command failed because of incorrect shell syntax. I corrected the quoting and executed:

/usr/bin/php7.3 -r 'pcntl_exec("/bin/sh", ["-p"]);'

The command replaced the PHP process with /bin/sh. The -p option preserved the elevated effective privileges inherited from the SUID interpreter.

I ran whoami in the resulting shell and received root, confirming successful privilege escalation.

9. Findings and remediation

Navigate CMS remote code execution

I exploited the vulnerable CMS to execute commands as www-data. This exposed the application’s files and resources accessible to its service account and provided a foothold for further compromise.

I recommended upgrading or replacing the vulnerable CMS, restricting unnecessary application functionality, and limiting service-account permissions.

SUID PHP privilege escalation

I used the privileged PHP interpreter to escalate from www-data to a root-effective shell. Combined with the CMS vulnerability, this enabled full host compromise.

I recommended removing unnecessary SUID permissions from interpreter binaries, auditing privileged executable ownership and permissions, and enforcing least privilege.

Conclusion

I completed the attack chain from web application exploitation to root access. The assessment demonstrated how a vulnerable CMS and an unnecessarily privileged interpreter could be chained to compromise the entire host.