ftp 21 [initial Access]
Checking FTP:
ftp $authbyanonymous
anonymous
I will check log folder first.
There is lots of log present. Let's downlaod it to the kali linux.
unable to download file though anonymous user ftp. Getting access denied.
Then i listed accounts directory and found that there is one admin account.
I tried to login using admin:admin and offsec:offsec in FTP.
Admin password worked but offsec failed.
Downlaoded index.php but nothing import found inside it.
Looking at .htpasswd file
This revealed the password of offsec.
I will be cracking the password.
Cracked.
Login using offsec credential
In backup there, I can see that there is .uac file.
.uac file prevent unauthorized modification.
This means if I delete this file, then i can download the file to my kali linux.
FTP to RCE [Worked]:
As i have FTP on the root directory of website. I will uplaod the reverse shell file and get the shell.
Tried PHP reverse shell from pentest monkey and Ivan sincek but didn't work.
We can see there is .php file present. I will add this php file to execute the command.
Uplaod this to the ftp of admin.
visit this page and run the command as needed.
First let's find which type of shell it is using cmd or powershell.
it is using CMD.
Uploading reverse shell [Worked].
I will be using reverse shell website for makinga reverse shell.
In ftp, run below command to uplaod the file.
Run curl command in terminal of kali linux after starting listener.
Got the shell !!
I got the shell using PHP reverse shell but unable to run the exe file using this. I tried during my privilege escalation method.
Using nc [working]
Other way using NC
First, find out the net cat in Kali Linux.
Make sure you add php backdoor and not reverse shell file.
Copy it to the current working directory and then upload it to the web directory using ftp.
Now we will run command and check if we are able to run the command or not.
Great !! It's working. We will now get the shell using nc.exe tool.
Start the listener.
URL Encoding the command:
Final command to run:
Got the shell.
Last updated
Was this helpful?