With a whole scan of 192.168.20.0/24 I found 4 servers.
This is the write-up for the server 192.168.20.10, called “Level 1”.
This is an extract of the Nmap scan :
Nmap scan report for 192.168.20.10
Host is up (0.066s latency).
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
80/tcp open http
|_ /phpbb/: Forum
| Server: Microsoft-IIS/7.0
| X-Powered-By: ASP.NET
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn
445/tcp open netbios-ssn
3306/tcp open mysql MySQL (unauthorized)
3389/tcp open ms-wbt-server Microsoft Terminal Service
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| OS: Windows Server (R) 2008 Standard 6002 Service Pack 2 (Windows Server (R) 2008 Standard 6.0)
As seen above it’s a Windows server, running :
– a PhpBB forum, available in /phpbb.
– a MySQL server, but we aren’t allowed to connect on.
– a TSE, but we don’t have any credential.
The forum should be the way to get a shell!
After few attempts:
– we can’t register ourselves.
– there was a captcha on the login page.
– exploits for PhpBB 3 needs to be authenticated.
Sometimes I got a SQL error message “Duplicate entry … for key ‘PRIMARY’ ” due to the captcha plugin but nothing more.
What was the next step then? Probably a SQL injection… but where ?
A hint has been given few days after:
ucp.php action parameters.
Ok… let’s see in the source code of the ucp.php page.
I tried several parameters until I got this error message:
It’s time to exploit it and bypass the error message “HACKING ATTEMPT” when playing with the u parameter. 🙂
The table phpbb471.ecsi_users seems interesting, I selected a few columns :
What is the RDP column? A “hint” for TSE allowed users? 🙂
After brute forcing the PhpBB password for user thegimp :
$H$9qjoQsN1nh3.bA/ek8d7G7QfWwyE2T0 | password1
I opened a RDP connection to the server with user “thegimp” and password “password1”.
Then I found the proof file: