17 OWASP A6 Security Misconfiguration Pt 1
Top 10 is security misconfiguration. It applies to default configurations, unpatched applications, out of date software, ad hoc configurations, open cloud storage, misconfigured HTTP headers, and proposed error messages containing sensitive information. Let's take a look at beat box. Down to security misconfiguration. See here insecure. Show secure file transfer. FTP to the beat box. Specify username of anonymous. And no password. Now the issue here is we're able to anonymously log into FTP. This destroys accountability and allows us to access the FTP server without using a password. Also, any of the documents in here, if they have sensitive data, anybody can download it and anybody can access that DP server regardless of authorization. Now back to be well. See here that there are two local privilege escalation vulnerabilities. Now to exploit these vulnerabilities, we need some sort of access to the system. So remember the low privilege shell we were able to get with the PHP backdoor. Let's get that again and escalate our privileges to root. This is a refresher. Here's how we are able to get the low privilege shell. MSF console startup Metasploit. Use exploit multi handler. Set L host localhost is in Cali Lennox box, set L 44446. That's the port that was specified in the payload that was generated. Set payload PHP word slash interpreter reverse TCP. Run. Now ready to leverage our. Remote file inclusion vulnerability. Here it is. We have a session open. It's changed to a shell. Now let's run a Python one liner to spawn a TTY shell. Make it more interactive. Good.