Slort Proving Grounds Write-Up

SUMMARY

This write-up covers the Slort machine from Offsec’s Proving Grounds, a Windows machine where a vulnerable PHP web application led to remote code execution and a simple privilege escalation through a scheduled binary.

Port 8080 served a default XAMPP page. Directory fuzzing revealed a /site subdirectory, and further fuzzing inside it uncovered additional PHP files. Examining the URL of the site revealed a file inclusion parameter testing it confirmed both LFI and RFI. A malicious rev.php was hosted on the attacker’s HTTP server and included via the RFI parameter, which executed the PHP code on the victim machine. This was used to download nc.exe and send a reverse shell as user rupert.

Inside the machine, a C:\Backup directory contained a binary (TFPT.exe) and a note stating the binary was executed every five minutes. Listing permissions with icacls showed the current user had full control over the file. The binary was replaced with a msfvenom payload, and after a few minutes a shell as Administrator was received.

---

PATH TO FOLLOW

1. Reconnaissance & XAMPP Discovery on Port 8080
2. Directory Fuzzing & File Inclusion Parameter Discovery
3. LFI/RFI Confirmation & Remote PHP Execution
4. Reverse Shell as rupert
5. Scheduled Binary Discovery in C:\Backup
6. Writable Binary Replacement with msfvenom Payload
7. Shell as Administrator

Due to OffSec’s policy on content sharing, these write-ups will provide hints only rather than full solutions.I know, boring stuff.