Web
Nmap discovered a Web server on the target port 80
The running service is Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 302 Found
Date: Mon, 14 Apr 2025 18:06:45 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
X-Powered-By: PHP/7.4.6
Location: http://192.168.167.55/dashboard/
Content-Length: 0
Content-Type: text/html; charset=UTF-8
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ curl -I http://$IP/
HTTP/1.1 302 Found
Date: Mon, 14 Apr 2025 18:06:49 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
X-Powered-By: PHP/7.4.6
Location: http://192.168.167.55/dashboard/
Content-Type: text/html; charset=UTF-8/Practice/Shenzi/2-Enumeration/attachments/{004339C0-5BEE-47C7-975B-68B1BFD08BC3}.png)
Webroot
Redirected to the /dashboard endpoint, where there is a default XAMPP installation page
This could possibly the mirror of the instance on the target port 443
phpinfo
/Practice/Shenzi/2-Enumeration/attachments/{0E6329BA-ADE6-40F4-9A1F-D9BD2BEC3287}.png)
phpinfo page is available at the /dashboard/phpinfo.php endpoint
/Practice/Shenzi/2-Enumeration/attachments/{93104A6F-E778-4FC7-85F9-41F21A8CE38F}.png)
/Practice/Shenzi/2-Enumeration/attachments/{72E91BD3-C78F-46BC-8FFC-ECA7A093A9F0}.png)
Checking the Environment section reveals the username; shenzi
phpMyAdmin
/Practice/Shenzi/2-Enumeration/attachments/{6384AD55-E030-413F-91D3-CD51E6DBD1FD}.png)
localhost only
/shenzi
/Practice/Shenzi/2-Enumeration/attachments/{B94797A2-661F-458B-BFC2-FA55488F3B03}.png)
There is a web application running on the /shenzi/ endpoint
WordPress
/Practice/Shenzi/2-Enumeration/attachments/{17C72F79-5B80-4776-8DC5-CEE999732D82}.png)
It is a WordPress instance.
This was initially suggested due to the exposure in one of the files found in the target SMB server
/Practice/Shenzi/2-Enumeration/attachments/Pasted-image-20250414212728.png)
/Practice/Shenzi/2-Enumeration/attachments/{E66F4549-48C6-42C1-81F5-16C3621DCBE2}.png)
Successfully authenticated using the admin credential; admin:FeltHeadwallWight357
Given that the admin user has administrative access to the instance, I could easily get code execution
Fuzzing
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
:: Method : GET
:: URL : http://192.168.167.55/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
Index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 21ms]
applications.html [Status: 200, Size: 3607, Words: 770, Lines: 80, Duration: 23ms]
dashboard [Status: 301, Size: 344, Words: 22, Lines: 10, Duration: 22ms]
favicon.ico [Status: 200, Size: 30894, Words: 412, Lines: 6, Duration: 20ms]
img [Status: 301, Size: 338, Words: 22, Lines: 10, Duration: 29ms]
index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 35ms]
xampp [Status: 301, Size: 340, Words: 22, Lines: 10, Duration: 22ms]
:: Progress: [81912/81912] :: Job [1/1] :: 360 req/sec :: Duration: [0:02:29] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/dashboard/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
:: Method : GET
:: URL : http://192.168.167.55/dashboard/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
404.html [Status: 200, Size: 4384, Words: 915, Lines: 122, Duration: 18ms]
FAQ.html [Status: 200, Size: 31751, Words: 6614, Lines: 524, Duration: 21ms]
Images [Status: 301, Size: 351, Words: 22, Lines: 10, Duration: 23ms]
Index.html [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 29ms]
de [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 20ms]
docs [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 102ms]
es [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 18ms]
faq.html [Status: 200, Size: 31751, Words: 6614, Lines: 524, Duration: 30ms]
favicon.ico [Status: 200, Size: 1150, Words: 4, Lines: 1, Duration: 19ms]
fr [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 20ms]
howto.html [Status: 200, Size: 6021, Words: 942, Lines: 132, Duration: 26ms]
hu [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 24ms]
images [Status: 301, Size: 351, Words: 22, Lines: 10, Duration: 22ms]
index.html [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 30ms]
it [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 20ms]
javascripts [Status: 301, Size: 356, Words: 22, Lines: 10, Duration: 23ms]
jp [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 22ms]
phpinfo.php [Status: 200, Size: 78447, Words: 3908, Lines: 897, Duration: 21ms]
pl [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 19ms]
pt_BR [Status: 301, Size: 350, Words: 22, Lines: 10, Duration: 17ms]
pt_br [Status: 301, Size: 350, Words: 22, Lines: 10, Duration: 17ms]
ro [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 19ms]
ru [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 32ms]
stylesheets [Status: 301, Size: 356, Words: 22, Lines: 10, Duration: 20ms]
tr [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 19ms]
ur [Status: 301, Size: 347, Words: 22, Lines: 10, Duration: 25ms]
zh_CN [Status: 301, Size: 350, Words: 22, Lines: 10, Duration: 19ms]
zh_TW [Status: 301, Size: 350, Words: 22, Lines: 10, Duration: 21ms]
zh_tw [Status: 301, Size: 350, Words: 22, Lines: 10, Duration: 22ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1015 req/sec :: Duration: [0:03:03] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic
________________________________________________
:: Method : GET
:: URL : http://192.168.167.55/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 19ms]
img [Status: 200, Size: 1217, Words: 84, Lines: 18, Duration: 35ms]
cgi-bin [Status: 403, Size: 1060, Words: 103, Lines: 43, Duration: 58ms]
icons [Status: 200, Size: 74798, Words: 7383, Lines: 1005, Duration: 88ms]
dashboard [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 29ms]
xampp [Status: 200, Size: 772, Words: 61, Lines: 16, Duration: 40ms]
:: Progress: [207630/207630] :: Job [1/1] :: 477 req/sec :: Duration: [0:07:12] :: Errors: 0 ::N/A