InfoSec LAB

Craft2_Web

Created: 4 min read

Web

Nmap discovered a Web server on the port 80 of the 192.168.103.188 host. The running service is Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/craft2]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Fri, 04 Jul 2025 16:11:38 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
X-Powered-By: PHP/8.0.7
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/craft2]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Fri, 04 Jul 2025 16:11:40 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
X-Powered-By: PHP/8.0.7
Content-Type: text/html; charset=UTF-8

Webroot

Admin Panel

The Admin Login button does not lead anywhere

File Upload

File upload is available at the signup section.

Uploading a testing file sends a POST request to the /upload.php endpoint.

Failed. It’s expecting a ODT file. This suggests a phishing opportunity to upload a macro-enabled ODT file.

Domain

The signup section also contains a domain; craft.offsec

The domain information has been appended to the /etc/hosts on Kali for local DNS resolution.

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/craft2]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php -fs 304
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.103.188/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 304
________________________________________________
Index.php               [Status: 200, Size: 9768, Words: 3463, Lines: 167, Duration: 20ms]
assets                  [Status: 301, Size: 343, Words: 22, Lines: 10, Duration: 21ms]
css                     [Status: 301, Size: 340, Words: 22, Lines: 10, Duration: 19ms]
index.php               [Status: 200, Size: 9768, Words: 3463, Lines: 167, Duration: 24ms]
js                      [Status: 301, Size: 339, Words: 22, Lines: 10, Duration: 21ms]
licenses                [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 20ms]
phpmyadmin              [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 21ms]
server-info             [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 22ms]
server-status           [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 19ms]
upload.php              [Status: 200, Size: 537, Words: 68, Lines: 9, Duration: 79ms]
uploads                 [Status: 301, Size: 344, Words: 22, Lines: 10, Duration: 21ms]
webalizer               [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 20ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1754 req/sec :: Duration: [0:00:47] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/craft2]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -u http://$IP/FUZZ/ -ic -fs 304
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.103.188/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 304
________________________________________________
                        [Status: 200, Size: 9768, Words: 3463, Lines: 167, Duration: 23ms]
uploads                 [Status: 200, Size: 777, Words: 61, Lines: 16, Duration: 24ms]
icons                   [Status: 200, Size: 73983, Words: 7383, Lines: 1005, Duration: 40ms]
assets                  [Status: 200, Size: 1196, Words: 114, Lines: 18, Duration: 28ms]
css                     [Status: 200, Size: 980, Words: 83, Lines: 17, Duration: 24ms]
js                      [Status: 200, Size: 981, Words: 86, Lines: 17, Duration: 23ms]
licenses                [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 23ms]
phpmyadmin              [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 21ms]
webalizer               [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 20ms]
server-status           [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 20ms]
css%20                  [Status: 200, Size: 982, Words: 85, Lines: 17, Duration: 23ms]
server-info             [Status: 403, Size: 423, Words: 37, Lines: 12, Duration: 24ms]
:: Progress: [1185241/1185241] :: Job [1/1] :: 2020 req/sec :: Duration: [0:12:33] :: Errors: 0 ::
  • /uploads/

/uploads/ Endpoint

Possibly the endpoint where uploaded files are stored.

Virtual Host / Sub-domain Discovery

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/craft2]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.craft.offsec' -ic -mc all -fs 9768
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.103.188/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.craft.offsec
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
 :: Filter           : Response size: 9768
________________________________________________
:: Progress: [114438/114438] :: Job [1/1] :: 288 req/sec :: Duration: [0:02:24] :: Errors: 0 ::

N/A

Interactive Graph View

Backlinks