## https://sploitus.com/exploit?id=4F95A9E3-7436-5A3B-BC3F-351C5F07924B
# Case Study: Foothold-to-Root Exploit Chain & Remediation
**Project:** [REDACTED_ID] Stage 6 (Ethical Hacking / VAPT Track)
**Role:** Exploit Developer & Security Analyst
**Technologies:** Python 3, Bash, Vagrant, VirtualBox, Pytest
## 📌 Executive Summary
For this stage of the Ubuntu Bridge Initiative (UBI), I developed a fully automated, **non-Metasploit exploit chain** capable of compromising a vulnerable Linux VM from initial foothold to root access. Beyond just exploitation, the project required root-cause analysis, idempotency, and the implementation of security patches to remediate the vulnerabilities.
## 🎯 Objectives
* Write a reliable exploit chain in Python to compromise an offline Vagrant VM.
* Exploit an initial web vulnerability and chain it with a local privilege escalation (LPE) vector.
* Ensure the exploit runs reliably across multiple clean snapshots (idempotent cleanup).
* Develop and apply root-cause patches, validating them via negative regression testing.
## 🛠️ Vulnerability Analysis & Exploit Chain
### 1. Initial Access (Foothold)
* **Vulnerability:** Command Injection in the `/diagnose` HTTP endpoint of the `netforge-support` application.
* **Exploitation:** Leveraged the injection to upload payload option files and establish a reverse shell, bypassing initial input filters.
### 2. Privilege Escalation (Root)
* **Vulnerability:** Tar Wildcard Injection via a misconfigured SUID binary.
* **Exploitation:** The system executed a backup script (`/usr/local/sbin/support-backup`) with SUID privileges using `tar *`. By crafting specific file names (`--checkpoint=1`, `--checkpoint-action=exec=sh`), I manipulated the tar command into executing a shell with effective UID 0 (root).
### 3. Idempotent Execution & Cleanup
The Python script was engineered with preflight checks and explicit protocol handling. After capturing the `user` and `root` flags, the script automatically reverted modifications and removed custom payload files to avoid leaving forensic artifacts.
## 🛡️ Remediation & Negative Testing
* **Patching:** I rewrote the `/diagnose` input validation logic in `/opt/netforge-support/app.py` to strictly accept valid IP addresses, completely neutralizing the command injection.
* **Testing:** Applied the patches to the active VM and ran automated negative regression tests using `pytest` to prove the exploit failed while legitimate service behavior remained intact (returning HTTP 400 for malicious payloads).
## 🚀 Usage & Execution
### 1. Execute the Exploit Chain
Run the complete exploit chain against the vulnerable target VM:
```bash
python3 exploit-chain/exploit.py --host 192.168.77.21 --port 8080
```
### 2. Reliability Testing
Run the automated script to test reliability across multiple clean snapshot restores:
```bash
python3 replay_runs.py --start 2 --end 5
```
### 3. Negative Regression Testing
Verify that the exploit fails after the root-cause patches are applied:
```bash
python3 -m pytest tests/test_exploit.py -v --junitxml=negative-retest.xml
```
---
*This project highlights my capability to perform end-to-end vulnerability research, develop reliable automated exploits without relying on public frameworks, and properly secure systems against the identified threats.*