Case Study: Foothold-to-Root Exploit Chain & Remediation

Project: [REDACTED_ID] Stage 6 (Ethical Hacking / VAPT Track)
Role: Exploit Developer & Security Analyst
Technologies: Python 3, Bash, Vagrant, VirtualBox, Pytest

Executive Summary

For this stage of the Ubuntu Bridge Initiative (UBI), I developed a fully automated, non-Metasploit exploit chain capable of compromising a vulnerable Linux VM from initial foothold to root access. Beyond just exploitation, the project required root-cause analysis, idempotency, and the implementation of security patches to remediate the vulnerabilities.

Objectives

• Write a reliable exploit chain in Python to compromise an offline Vagrant VM.
• Exploit an initial web vulnerability and chain it with a local privilege escalation (LPE) vector.
• Ensure the exploit runs reliably across multiple clean snapshots (idempotent cleanup).
• Develop and apply root-cause patches, validating them via negative regression testing.

Vulnerability Analysis & Exploit Chain

1. Initial Access (Foothold)

• Vulnerability: Command Injection in the /diagnose HTTP endpoint of the netforge-support application.
• Exploitation: Leveraged the injection to upload payload option files and establish a reverse shell, bypassing initial input filters.

2. Privilege Escalation (Root)

• Vulnerability: Tar Wildcard Injection via a misconfigured SUID binary.
• Exploitation: The system executed a backup script (/usr/local/sbin/support-backup) with SUID privileges using tar *. By crafting specific file names (--checkpoint=1, --checkpoint-action=exec=sh), I manipulated the tar command into executing a shell with effective UID 0 (root).

3. Idempotent Execution & Cleanup

The Python script was engineered with preflight checks and explicit protocol handling. After capturing the user and root flags, the script automatically reverted modifications and removed custom payload files to avoid leaving forensic artifacts.

Remediation & Negative Testing

• Patching: I rewrote the /diagnose input validation logic in /opt/netforge-support/app.py to strictly accept valid IP addresses, completely neutralizing the command injection.
• Testing: Applied the patches to the active VM and ran automated negative regression tests using pytest to prove the exploit failed while legitimate service behavior remained intact (returning HTTP 400 for malicious payloads).

Usage & Execution

1. Execute the Exploit Chain

Run the complete exploit chain against the vulnerable target VM:

python3 exploit-chain/exploit.py --host 192.168.77.21 --port 8080

2. Reliability Testing

Run the automated script to test reliability across multiple clean snapshot restores:

python3 replay_runs.py --start 2 --end 5

3. Negative Regression Testing

Verify that the exploit fails after the root-cause patches are applied:

python3 -m pytest tests/test_exploit.py -v --junitxml=negative-retest.xml

---

This project highlights my capability to perform end-to-end vulnerability research, develop reliable automated exploits without relying on public frameworks, and properly secure systems against the identified threats.