InfoSec LAB

FunboxEasyEnum_Web

Created: 2 min read

Web

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 2.4.29 ((Ubuntu))

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/funboxeasyenum]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Wed, 30 Apr 2025 21:04:28 GMT
Server: Apache/2.4.29 (Ubuntu)
Allow: POST,OPTIONS,HEAD,GET
Content-Length: 0
Content-Type: text/html
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/funboxeasyenum]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Wed, 30 Apr 2025 21:04:30 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Fri, 18 Sep 2020 16:30:12 GMT
ETag: "2aa6-5af9903d91639"
Accept-Ranges: bytes
Content-Length: 10918
Vary: Accept-Encoding
Content-Type: text/html

Webroot It’s the default Apache installation page

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/funboxeasyenum]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.187.132/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
index.html              [Status: 200, Size: 10918, Words: 3499, Lines: 376, Duration: 19ms]
javascript              [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 18ms]
mini.php                [Status: 200, Size: 3828, Words: 152, Lines: 115, Duration: 21ms]
phpmyadmin              [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 19ms]
robots.txt              [Status: 200, Size: 21, Words: 2, Lines: 2, Duration: 20ms]
:: Progress: [81920/81920] :: Job [1/1] :: 230 req/sec :: Duration: [0:00:48] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/funboxeasyenum]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.187.132/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
                        [Status: 200, Size: 10918, Words: 3499, Lines: 376, Duration: 3771ms]
phpmyadmin              [Status: 200, Size: 10531, Words: 504, Lines: 26, Duration: 133ms]
:: Progress: [207631/207631] :: Job [1/1] :: 2105 req/sec :: Duration: [0:01:54] :: Errors: 0 ::
  • /mini.php
  • /phpmyadmin/
  • /robots.txt

/mini.php

  • It claims to be Zerion Mini Shell 1.0
  • It seems to be running off of the web root directory; /var/www/html
  • It appears to support file upload Moving on to the exploitation phase.

/phpmyadmin/

No credential is known at this time

/robots.txt

Allow: Enum_this_Box

Interactive Graph View

Backlinks