> For the complete documentation index, see [llms.txt](https://meowsec.gitbook.io/vulnhub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://meowsec.gitbook.io/vulnhub/easy-1/list1/potato-1.md).

# Potato 1

Easy, Real life like

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuJqnzHCgMDUmAxGVg%2F-MVuLKa7VqGg50OKsD2R%2F1.png?alt=media\&token=fb861123-dcc6-413c-842a-b8c84ba3abd6)

I have completed this in 3 steps.

1. **Enumeration**: Nmap helped to get in
2. **Exploitation**: Burp proxy and php vulnerability
3. **Post exploitation**: Abusing admin permission

So let's talk in detail.

### 1. Enumeration

1\) At first, I need to know the target IP, so:

```
 netdiscover -i eth0 -r 10.0.0.0/16
```

and I got the IP: 10.0.2.39

2\) As always I have started with all port scanning

```
nmap -p- -v -Pn 10.0.2.39
```

and I have got 3 ports open:

```
Discovered open port 22/tcp on 10.0.2.39
Discovered open port 80/tcp on 10.0.2.39
Discovered open port 2112/tcp on 10.0.2.39
```

3\) Now digging deeper to those ports:

```
nmap -sV -O -p80,22,2112 -v -Pn 10.0.2.39
```

An unusual port running FTP:

```
PORT     STATE     SERVICE     VERSION
22/tcp     open         ssh      OpenSSH 8.2p1 Ubuntu
80/tcp     open         http     Apache httpd 2.4.41 ((Ubuntu))
2112/tcp   open         ftp       ProFTPD
```

4\) As it has a web page, so I have started dirbuster to scan:

![Running the scan](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuJqnzHCgMDUmAxGVg%2F-MVuM4RXIzt0He-mB_cf%2F2.png?alt=media\&token=0521677e-3e93-4f6e-b516-bc75840b4c69)

![Scan result](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuJqnzHCgMDUmAxGVg%2F-MVuM9km06Kd-kI88kd6%2F3.png?alt=media\&token=d7bbec8a-e9e4-4e3b-806f-57045e352cca)

5\) Nikto scan also reveals similar info to dirbuster:

```
nikto -h http://10.0.2.39/
```

Scan report is:

```
+ Server: Apache/2.4.41 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-3092: /admin/: This might be interesting...
+ OSVDB-3093: /admin/index.php: This might be interesting... has been seen in web logs from an unknown scanner.
```

6\) Found /admin, /admin/index.php. These page are showing one login form.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuJqnzHCgMDUmAxGVg%2F-MVuMWsAbmftQgbaVzbf%2F4.png?alt=media\&token=eb0ee429-47cc-4527-875c-0789f94dc562)

7\) Attempted to brute force or guess the password I have failed

8\) Found logs.txt but nothing interesting found except - Admin has changed password.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuJqnzHCgMDUmAxGVg%2F-MVuMr9mDp2bgg1aICCa%2F5.png?alt=media\&token=a59a2a45-7c74-4774-b432-9c8e7f54425d)

9\) After some failed attempt to brute force, I have focused on FTP. FTP login: 

```
ftp -p 10.0.2.39 2112
```

I have found:\
 \- anonymous login allowed\
 \- found 2 interesting files

```
-rw-r--r-- 1 ftp ftp 901 Aug 2 19:33 index.php.bak
-rw-r--r-- 1 ftp ftp 54 Aug 2 18:17 welcome.msg
```

downloaded those files:

```
 get index.php.bak
```

### 2. Exploitation

10\) From index.php.bak, I can see the source code:

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuPkRnytwct2nMxGDB%2F6.png?alt=media\&token=797b2df2-f389-4ad2-961a-1a4d6204258b)

11\) I have tried SQL injection but failed. After some research, I have found this article about - [type juggling](https://owasp.org/www-pdf-archive/PHPMagicTricks-TypeJuggling.pdf). It helps!

12\) Successfully exploited this vulnerability. I have used - password\[]=""

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuPxxjACX2N1sC7j8u%2F7.png?alt=media\&token=a4bfa716-fd98-446f-b30c-2ab050e9d599)

13\) Result: 

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuQ3lwt3jZhGqmN7yT%2F8.png?alt=media\&token=5b22afd5-2d38-40c3-b976-2f54be0d9131)

14\) But I am facing access denied message:

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuQ9GMigrk4qIvgakq%2F9.png?alt=media\&token=2d8d6e0f-b595-446e-a23d-cec0fb743446)

15\) Other pages don't have any interesting this except the Logs. I have intercepted all the request with Burp. And I have found an interesting entry in logs. This will probably lead to LFI.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuQH7002gUzxnUesqb%2Fa.png?alt=media\&token=8c828517-9a92-4f57-9e9c-34d7c9f17070)

16\) I have tried *file=../../../../../etc/passwd*

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuQUigPmu4X61_Qh3e%2Fb.png?alt=media\&token=979beb20-694b-497d-95cc-01efb3e92979)

17\) got = webadmin:$1$webadmin$3sXBxGUtDGIFAcnNTNhi6. Here I have used john the ripper and I have got: 

1. user: webadmin 
2. pass: dragon

18\) Now login to ssh 

```
ssh webadmin@10.0.2.39
```

and eventually I have found the user flag

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuQpKQ8xd69ErsGVxG%2Fw.png?alt=media\&token=58819cf2-9400-4e64-92ae-0bbf9319d748)

### 3. Post Exploitation

19\) Now I need root access. I have searched for another profile then webadmine's privilege

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuRCNwNh1wfv-IqG9Y%2Fx.png?alt=media\&token=7282c177-4e64-4b84-9c75-6c5651418580)

20\) Here, webadmin cat execute /notes and anything after it. That's the key point! I have created a small shell and executed it.

![](https://2253465825-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MVtwKyoxnvnrXpBj15q%2F-MVuOrqc0pvOZQqFRN9Q%2F-MVuRNEWacaRtgnx6ctY%2Fy.png?alt=media\&token=0009d76e-f27d-4849-98d3-7c7455aa9274)

21\) Finally I have got root flag in /root/root.txt 

> bGljb3JuZSB1bmlqYW1iaXN0ZSBxdWkgZnVpdCBhdSBib3V0IGTigJl1biBkb3VibGUgYXJjLWVuLWNpZWwuIA==

Hope this write up will help you. Any feedback is appreciated