themursalin/magic_walkthrough

This repo is an educational walkthrough of how to attack a deliberately vulnerable practice machine called Magic, which is one of the boxes hosted on a hacking training platform. The author works through it like a security report, taking the reader from the first network scan all the way to taking over the machine as the root administrator, with every command, tool output, and explanation included. It is marked as Internal Use Only and presented as a personal writeup, not a tool or a library. The walkthrough opens with port scanning using nmap, which finds only an SSH service and a web server running Apache on Ubuntu. The web server hosts a simple image portfolio site with a login page. The author bypasses that login using a textbook SQL injection trick, typing a magic value into the username field that makes the database always return true, and is dropped onto an upload page. Next comes the file upload bypass. The upload only accepts images, but the filename check is sloppy: it looks at the end of the filename without rejecting filenames that also contain .php, and the server is misconfigured to run any file with .php anywhere in its name. The author builds a polyglot file called avatar.php.png, a real PNG image with a tiny PHP web shell hidden inside the raw bytes. Once uploaded and visited in a browser, this gives remote command execution as the web server user, which is then upgraded to a full interactive shell over the network. From there the writeup walks through reading database credentials out of a config file called db.php5, dumping the database with mysqldump to recover a plaintext admin password, and reusing that same password to switch to the local user theseus. The final step is escalating to root by abusing a setuid binary called sysinfo that calls helper commands like fdisk without giving their full path. The author places a fake fdisk script in a writable directory, prepends that directory to the PATH environment variable, and the privileged binary runs the fake script as root, handing back a root shell. A final section reviews why the box was vulnerable in the first place, pointing at a permissive .htaccess override in the Apache configuration that weakened the PHP file handler check. The repo has zero stars and is just a single long markdown report rather than runnable code.