Knife
TARGET IP: 10.10.10.242
HOST IP: 10.10.16.3
RECON
WEBSITE
The page seems like a typical medical page. The source code for the page doesn't have anything to note except for some javascript that takes care of the styling when you first log into the page.
I'll also note that there are no links on this page or noted in the source code. Other than third-party links.
Looks like we have a lot of good information from Wappalyzer.
Apache Web Server V2.4.41
Backend --> PHP v8.1.0
This is the route we need to go with. It doesn't have it here but the version is v8.1.0dev
OS --> Ubuntu
After a quick google search, it appears that the Apache Web server has several vulnerabilities. Metasploit might even have a module to exploit it.
From the Gobuster Scan below, I found a
/index.php
page.This is just the same home page.
NMAP
We can confirm that the Apache web Server is using V2.4.41
NIKTO
First time using nikto here and interesting tool.
This shows that the PHP version used is
8.1.0-dev
A quick google search shows that this is a development version of PHP and has a major vulnerability.
ENUMERATION
GOBUSTER
EXPLOITATION
Let's dive into possible exploitations for the Apache version.
The Apache website actually has a list of all vulnerabilities which is really handy.
Nothing sticks out specifically for this version but it looks like the version may still be susceptible to multiple attacks.
I'm pretty sure this is not the route to go.
Let's take a look
METASPLOIT
Tried a few exploits available but nothing really stuck.
No luck here with Apache.
PHP
From the Nikto scan I found that the PHP version is 8.1.0-dev which has a major vulnerability that allows for a backdoor into the server.
I found a really useful python script that creates a reverse shell using this backdoor.
I created a new file with the code snippet above and ran the following.
Return back to your netcat listener and you should now have access to the system.
Here is the user flag.
PRIVILEGE ESCALATION
Start with allowable sudo privileges.
Let's go check out GTFOBins for a possible route to escalation.
Last updated