β Poison (Medium)
Lesson Learn
Report-Penetration
Vulnerable Exploit: LFI, Misconfigure on phpinfo lead to race condition and RCE.
System Vulnerable: 10.10.10.84
Vulnerability Explanation: The machine is vulnerable to LFI and leak credential file which we could decrypt and have access to the machine.
Privilege Escalation Vulnerability: Password Reuse
Vulnerability Fix: Proper input validation and Not allow password reuse.
Severity: High
Step to Compromise the Host:
Reconnaissance
Enumeration
Port 80 Apache httpd 2.4.29
By going through port 80, there is a web page
On file ini.php and info.php we didn't see any interesting information. But on listfiles.php, we see other files listed.
There is message mention it's encoded at least 13 times.
LFI Exploit
On the webpage, there is a file path. We can test for LFI. Our input will execute inside include().
#1 Exploit (SSH)
Decode 13 times
Let decoded base64 stored on pwdbackup.txt for 13 times and we found out that is password.
SSH to the machine with username we found on LFI vulnerable and password we just got.
#2 Exploit (phpinfo.php)
The machine is vulnerable to LFI and script display the output on phpinfo().
Proof of concept code: phpinfolfi.py
On the script we need to modify some paths.
Let start our netcat listener on port 4444 and run the python script.
#3 Exploit (Log-Poisoning)
Checking the location of the log file.
Let insert the location of the log file on the machine. On log, we found out there is user-agent.
Let change the content of User-Agent and replace with php code and it's display Testing. It mean we can control this.
Privilege Escalation
Let start copy secret.zip file on home directory of user charix.
Checking the process running, we found VNC running by root.
On netstat, we found localhost listening on port 5801 and 5901 which are VNC ports.
Local Port Forwarding
Actually we cannot access directly from our machine. Let start port forwarding.
Once we log in, we can see the ports were listen on our machine.
VNC Priv Esc
We can remote to VNC via ssh tunnel. Then, the shell pop up.
Last updated