Web
Nmap discovered a Web server on the target port 443
The running service is Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
/Practice/Shenzi/2-Enumeration/attachments/{1FB8F80A-26F0-463C-8228-7C66C55427DE}.png)
Webroot
Redirected to the /dashboard endpoint, where there is a default XAMPP installation page
This could possibly the mirror of the instance on the target port 80
phpinfo
/Practice/Shenzi/2-Enumeration/attachments/{D96BE4EF-C73C-4EFB-9C65-CA68E52816CF}.png)
phpinfo page is available at the /dashboard/phpinfo.php endpoint
/Practice/Shenzi/2-Enumeration/attachments/{93104A6F-E778-4FC7-85F9-41F21A8CE38F}.png)
/Practice/Shenzi/2-Enumeration/attachments/{72E91BD3-C78F-46BC-8FFC-ECA7A093A9F0}.png)
Checking the Environment section reveals the username; shenzi
phpMyAdmin
/Practice/Shenzi/2-Enumeration/attachments/{65B50DC8-36CC-47D3-B721-D85B5F2DC8C4}.png)
localhost only
/shenzi
/Practice/Shenzi/2-Enumeration/attachments/{9F5FEFE9-05AD-45ED-957F-6B3D811F7B01}.png)
There is a web application running on the /shenzi/ endpoint
WordPress
/Practice/Shenzi/2-Enumeration/attachments/{C2B7099A-116D-4E9C-8ABC-A8DE14E9B774}.png)
It is a WordPress instance.
This was initially suggested due to the exposure in one of the files found in the target SMB server
/Practice/Shenzi/2-Enumeration/attachments/Pasted-image-20250414212728.png)
/Practice/Shenzi/2-Enumeration/attachments/{B5F14536-D0AA-4DE9-B187-D11F91C906BB}.png)
Successfully authenticated using the admin credential; admin:FeltHeadwallWight357
Given that the admin user has administrative access to the instance, I could easily get code execution
Fuzzing
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u https://$IP/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
:: Method : GET
:: URL : https://192.168.167.55/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
Index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 28ms]
applications.html [Status: 200, Size: 3607, Words: 770, Lines: 80, Duration: 23ms]
dashboard [Status: 301, Size: 346, Words: 22, Lines: 10, Duration: 21ms]
favicon.ico [Status: 200, Size: 30894, Words: 412, Lines: 6, Duration: 19ms]
img [Status: 301, Size: 340, Words: 22, Lines: 10, Duration: 19ms]
index.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 21ms]
xampp [Status: 301, Size: 342, Words: 22, Lines: 10, Duration: 20ms]
:: Progress: [81912/81912] :: Job [1/1] :: 980 req/sec :: Duration: [0:02:00] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u https://$IP/dashboard/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
:: Method : GET
:: URL : https://192.168.167.55/dashboard/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
404.html [Status: 200, Size: 4384, Words: 915, Lines: 122, Duration: 31ms]
FAQ.html [Status: 200, Size: 31751, Words: 6614, Lines: 524, Duration: 24ms]
Images [Status: 301, Size: 353, Words: 22, Lines: 10, Duration: 19ms]
Index.html [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 21ms]
de [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 21ms]
docs [Status: 301, Size: 351, Words: 22, Lines: 10, Duration: 22ms]
es [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 22ms]
faq.html [Status: 200, Size: 31751, Words: 6614, Lines: 524, Duration: 22ms]
favicon.ico [Status: 200, Size: 1150, Words: 4, Lines: 1, Duration: 30ms]
fr [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 22ms]
howto.html [Status: 200, Size: 6021, Words: 942, Lines: 132, Duration: 22ms]
hu [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 21ms]
images [Status: 301, Size: 353, Words: 22, Lines: 10, Duration: 20ms]
index.html [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 21ms]
it [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 23ms]
javascripts [Status: 301, Size: 358, Words: 22, Lines: 10, Duration: 25ms]
jp [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 57ms]
phpinfo.php [Status: 200, Size: 82336, Words: 4064, Lines: 943, Duration: 27ms]
pl [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 25ms]
pt_BR [Status: 301, Size: 352, Words: 22, Lines: 10, Duration: 30ms]
pt_br [Status: 301, Size: 352, Words: 22, Lines: 10, Duration: 24ms]
ro [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 28ms]
ru [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 23ms]
stylesheets [Status: 301, Size: 358, Words: 22, Lines: 10, Duration: 20ms]
tr [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 23ms]
ur [Status: 301, Size: 349, Words: 22, Lines: 10, Duration: 32ms]
zh_CN [Status: 301, Size: 352, Words: 22, Lines: 10, Duration: 23ms]
zh_TW [Status: 301, Size: 352, Words: 22, Lines: 10, Duration: 30ms]
zh_tw [Status: 301, Size: 352, Words: 22, Lines: 10, Duration: 31ms]
:: Progress: [81912/81912] :: Job [1/1] :: 491 req/sec :: Duration: [0:02:59] :: Errors: 12 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shenzi]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u https://$IP/FUZZ/ -ic
________________________________________________
:: Method : GET
:: URL : https://192.168.167.55/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 33ms]
img [Status: 200, Size: 1218, Words: 84, Lines: 18, Duration: 63ms]
cgi-bin [Status: 403, Size: 1054, Words: 103, Lines: 43, Duration: 116ms]
icons [Status: 200, Size: 74798, Words: 7383, Lines: 1005, Duration: 503ms]
dashboard [Status: 200, Size: 7576, Words: 1305, Lines: 168, Duration: 38ms]
xampp [Status: 200, Size: 773, Words: 61, Lines: 16, Duration: 48ms]
[Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 41ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1052 req/sec :: Duration: [0:07:06] :: Errors: 0 ::N/A