# Photographer

1. Started with running a TCP Scan via NMAP

```bash
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 41:4d:aa:18:86:94:8e:88:a7:4c:6b:42:60:76:f1:4f (RSA)
|   256 4d:a3:d0:7a:8f:64:ef:82:45:2d:01:13:18:b7:e0:13 (ECDSA)
|_  256 1a:01:7a:4f:cf:95:85:bf:31:a1:4f:15:87:ab:94:e2 (ED25519)
80/tcp   open  http        Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Photographer by v1n1v131r4
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
8000/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))
|_http-title: daisa ahomi
|_http-trane-info: Problem with XML parsing of /evox/about
|_http-generator: Koken 0.22.24
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-open-proxy: Proxy might be redirecting requests
Service Info: Host: PHOTOGRAPHER; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 1h19m59s, deviation: 2h18m34s, median: 0s
| smb2-time: 
|   date: 2025-10-29T14:06:00
|_  start_date: N/A
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
|   Computer name: photographer
|   NetBIOS computer name: PHOTOGRAPHER\x00
|   Domain name: \x00
|   FQDN: photographer
|_  System time: 2025-10-29T10:06:00-04:00
|_nbstat: NetBIOS name: PHOTOGRAPHER, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.35 seconds

```

2. SMB was running on the server hence I used smbclient to enumerate the network shares present.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FR10lEkZ4UShlNIQ1K2Dx%2Fimage.png?alt=media&#x26;token=ad1226e4-5874-4e0d-8344-2231e6dc7379" alt=""><figcaption></figcaption></figure>

3. Enumerated the `sambashare` network share and found the following files

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FITHrHzha9GjIV2pgtFnq%2Fimage.png?alt=media&#x26;token=7e2b9b81-3c11-463b-a41f-4d6c568ea2bd" alt=""><figcaption></figcaption></figure>

4. Read the contents of `mailsent.txt` and found the following

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FszjAqidcXD6RzGTm4xuL%2Fimage.png?alt=media&#x26;token=7ec13086-d57b-4252-82bb-ee9d915fb3f3" alt=""><figcaption></figcaption></figure>

5. Here I could find two email addresses and what seemed like a secret key at the end of the file.
6. Next, I enumerated the ports and as revealed in the TCP scan, Koken CMS was running on port 80.
7. I looked up online for exploits of Koken and found a file-upload vulnerability of the same version as was running on the target.

<https://www.exploit-db.com/exploits/48706>

8. As it was an authenticated vulnerability I had to get the admin panel and the login credentials first. Hence I ran a directory scan using gobuster.
9. I found a `/admin` subdirectory and found the following login page

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FGZglzN7s0F1t2QWxhlFi%2Fimage.png?alt=media&#x26;token=a689db64-b8e6-43d7-b2a7-5b78997e4fec" alt=""><figcaption></figcaption></figure>

10. I used the `daisy@photographer.com` email address from the `mailsent.txt` file and used  `babygirl` as the password as was revealed in the same text file. Then, I was redirected to the following page.

    <figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2Fv2AoHVFDRNXSe3G0zLx0%2Fimage.png?alt=media&#x26;token=43a9481c-89e7-4772-9776-c1fae8a1b581" alt=""><figcaption></figcaption></figure>
11. After that I used the pentestmonkey PHP reverse shell and added it a file named `monkey.php.jpg`
12. I turned on Burp Suite.
13. I used the Import Content option on the Koken dashboard and uploaded the file. While uploading I captured the request in Burp Suite and modified the request by renaming the reverse shell file `monkey.php.jpg` to `monkey.php`.&#x20;
14. I resent the request and uploaded the reverse shell.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FWa1VAneNbslujc0cLCrs%2Fimage.png?alt=media&#x26;token=99651ce1-b66e-4c1e-ace5-6c9dc7683ec2" alt=""><figcaption></figcaption></figure>

15. I clicked on the file and visited the link given in the Inspector tab

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FARVZpyy0yQdMvGvI4fdg%2Fimage.png?alt=media&#x26;token=294c5ed6-be39-411a-8eda-8bd470c27a6b" alt=""><figcaption></figcaption></figure>

16. Upon opening the link I was redirected to the following page

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2F02e7DwoBpWxlwvaleDi8%2Fimage.png?alt=media&#x26;token=afae057b-3dc1-48a2-9a27-58283e505db1" alt=""><figcaption></figcaption></figure>

17. I started a reverse shell on the attacker device.
18. I visited the Download File link given on the webpage to get the location of where the file was being stored and initiate the reverse shell.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FDyvc5qdYOAlZK15tz2ec%2Fimage.png?alt=media&#x26;token=cf87c18a-9ef0-4759-a9ec-e2b011a9ff96" alt=""><figcaption></figcaption></figure>

19. I found the first flag in `/home/daisa` directory

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FeLiJzzynRquUHh7AFPfB%2Fimage.png?alt=media&#x26;token=1213ab64-0d5f-48a7-b35e-71a8121462e5" alt=""><figcaption></figcaption></figure>

20. Next, I enumerated the target for privilege escalation and found a `php7.2` binary with sticky bit.

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FK4riQ9q6d3VmocaMoukj%2Fimage.png?alt=media&#x26;token=d04d9b53-2e7d-4a7d-a0f4-fe40322f952c" alt=""><figcaption></figcaption></figure>

21. I went to the good old GTFObins and looked up exploits for php binary and found the following

```
CMD="/bin/sh"
./php -r "pcntl_exec('/bin/sh', ['-p']);"
```

22. I used the above commands and got a root shell

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FtyiofSLEQFVbTpTc420F%2Fimage.png?alt=media&#x26;token=1308189b-ff76-4ba3-9b7e-ed1497c92d27" alt=""><figcaption></figcaption></figure>

24. I found the final root flag inside the `/root` directory

<figure><img src="https://697415701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGOxHHc65JQOToz8nkPKh%2Fuploads%2FkPr7xnUXEkLOZ46O4NZE%2Fimage.png?alt=media&#x26;token=60b61a40-dd8a-4f10-bc16-162bfa09835d" alt=""><figcaption></figcaption></figure>