# Photobomb 10.10.11.182
## Background
Photobomb is a Linux base machine from HackTheBox that required your patience in web application knowledge with command injection techniques and the Linux basic concept of sudo is required on the privilege escalation. It is a basic OSCP-like Box.
Command Injection was found on a download function of this web application, which can help to gain initial access. [Linpeas ](https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS)show you there is a problem on a sudo job.
<130n@calvinlai.com>
Target Machine: 10.10.11.182
Attacker Machine: 10.10.14.7
## Hacking Process Part 0 – Service Scanning
### Nmap
1. nmap -p- -T5 --min-rate=1000 10.10.11.182 -oG fkclai.nmap
2. nmap -p $(grep -Eo '\[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV 10.10.11.182 -o nmap-result.txt
### Enumeration Strategies
No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check for any information leakage or misconfiguration.
## Hacking Process Part 1 – Enumeration
With basic web enumeration, a password was found on a JS file that can log on to an image download function. This download function has a command injection problem.
### Possible Command Injection
[Command Injection](https://owasp.org/www-community/attacks/Command_Injection) was found on the image download function, the Netcat command can have a response.
the reverse shell does not obtain using netcat reverse shell.
## Hacking Process Part 2 – Gaining Foothold
After several tries using the payload on the [reverse shell generator](https://www.revshells.com/), the payload in Python format can be used to obtain the reverse shell.
