Executive Summary

Introduction

This Pentest report documents the security assessment conducted on the IP address 10.10.10.84. The assessment aimed to identify vulnerabilities that could be exploited to compromise the security of the target infrastructure.

Objective

The objective of this security assessment was to identify and exploit vulnerabilities in the target's infrastructure to evaluate existing security measures and provide recommendations to mitigate the identified risks.

Requirements

• Identify vulnerabilities in the web application hosted at IP address 10.10.10.84.
• Exploit critical and moderate vulnerabilities to assess potential exposure to attacks.
• Evaluate the possibility of unauthorized access to systems and data.

High-Level Summary of Found Vulnerabilities

Web Server Enumeration

1. Local File Inclusion (Elevated): Local files of the system could be included by abusing a flaw in browse.php. To mitigate this, implement input validation and sanitize user input in the browse.php script to prevent directory traversal attacks. Additionally, restrict file access to a specific directory and implement a whitelist of allowed files that can be accessed through the script.

2. Sensitive Information Exposure (Elevated): A file (pwdbackup.txt) containing sensitive information was identified, base64 encoded. To improve security, avoid storing sensitive information like passwords or credentials in plain text or base64 encoding. Use encryption and secure storage methods. Implement proper access controls to restrict access to sensitive files and directories.

Initial Access - Exposed SSH Credentials

1. Exposed SSH Credentials (High): Credentials for the user "charix" were decoded, allowing unauthorized SSH access. To mitigate this, immediately change the passwords for user "charix."

Post Exploitation

1. LPE to root (Local Privilege Escalation to root) (Extreme): Credentials for the root user's VNC session were discovered in /home/charix/secret.zip. A tool called vncpwd was used to decrypt the stored VNC password, enabling remote access to the system as root. To prevent this, use secure storage mechanisms and encryption for sensitive data, and review and restrict access to critical files like /home/charix/secret.zip.

Recommendations

1. Implement input validation and sanitize user input in the browse.php script to prevent directory traversal attacks. Restrict file access to a specific directory and implement a whitelist of allowed files.
2. Avoid storing sensitive information in plain text or base64 encoding. Use encryption and secure storage methods for sensitive data and implement proper access controls to restrict access to sensitive files and directories.
3. Immediately change the passwords for user "charix" to prevent unauthorized SSH access.
4. Securely store sensitive data such as VNC passwords using encryption. Review and restrict access to critical files to prevent unauthorized disclosure of sensitive information.

Methodology

The assessment involved service enumeration, web server enumeration, and post-exploitation activities. Vulnerabilities in local file inclusion, sensitive information exposure, exposed SSH credentials, and local privilege escalation to root were identified and exploited. Recommendations focus on improving security measures to mitigate the identified risks.

Color Legend

Console color legend:

Risk Classification