> For the complete documentation index, see [llms.txt](https://writeups.greatmoves.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.greatmoves.xyz/hackthebox/knife.md).

# Knife

Write up for the HTB machine 'Knife'

## 1. Recon

***

### 1.1. nmap

A simple nmap scan: `nmap -sC -sV {target-ip}` reveals port 22-ssh and port 80-http.

### 1.2. nikto

A nikto scan using the command `nikto -host {target-ip}` reveals that the web application is using `PHP/8.1.0-dev`.

A quick google search of this PHP version shows us a Backdoor Remote Code Execution script found at: <https://github.com/flast101/php-8.1.0-dev-backdoor-rce>

Run the script along with a netcat listener and catch your reverse shell!

Navigate to /home/james for user.txt.

## 2. Privilege escalation

***

As our user let's see if there's anything they are able to run as root using the command `sudo -l`

which reveals:

```
User james may run the following commands on knife:
    (root) NOPASSWD: /usr/bin/knife
```

Looking up "knife" on <https://gtfobins.github.io/> we find the command `sudo knife exec -E 'exec "/bin/sh"'`, so let's run it.

root :)

Navigate to /root for root.txt