> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/photobomb-10.10.11.182.md).
# Photobomb 10.10.11.182
## Background
Photobomb is a Linux base machine from HackTheBox that required your patience in web application knowledge with command injection techniques and the Linux basic concept of sudo is required on the privilege escalation. It is a basic OSCP-like Box.
Command Injection was found on a download function of this web application, which can help to gain initial access. [Linpeas ](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS)show you there is a problem on a sudo job.
<130n@calvinlai.com>
Target Machine: 10.10.11.182
Attacker Machine: 10.10.14.7
## Hacking Process Part 0 – Service Scanning
### Nmap
1. nmap -p- -T5 --min-rate=1000 10.10.11.182 -oG fkclai.nmap
2. nmap -p $(grep -Eo '\[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.11.182 -o nmap-result.txt
### Enumeration Strategies
No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check for any information leakage or misconfiguration.
## Hacking Process Part 1 – Enumeration
With basic web enumeration, a password was found on a JS file that can log on to an image download function. This download function has a command injection problem.
### Possible Command Injection
[Command Injection](https://owasp.org/www-community/attacks/Command_Injection) was found on the image download function, the Netcat command can have a response.
the reverse shell does not obtain using netcat reverse shell.
## Hacking Process Part 2 – Gaining Foothold
After several tries using the payload on the [reverse shell generator](< https://www.revshells.com/>), the payload in Python format can be used to obtain the reverse shell.
{% hint style="info" %}
f1d429c717c9e2cebbfaf9ba33aacfc2
{% endhint %}
## Hacking Process Part 3 – Privilege Escalation
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/photobomb-10.10.11.182.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.