Writeup by wook413

EnumerationNmapInitial AccessSMB 445HTTP 80MySQL 3306Privilege Escalation

Enumeration

Nmap

initial Nmap scan result

Second Nmap scan on the discovered ports only with -sC and -sV flags.

UDP scan result

Initial Access

SMB 445

Every time I see SMB on the nmap scan result, I like to start off by smb-enum-shares and smb-enum-users scripts.

We see a share that’s not there by default: docs

Inside the share, there were 2 pdf files but the contents inside them didn’t get me anywhere.

HTTP 80

For HTTP, like I did for SMB, I started off with http-enum script which revealed /filemanager and /source shares.

The landing page of the website looks like below and they have 4 doctors. I took a note of their names since they might become useful for brute-forcing attack later.image-20260128193403156

image-20260128193423640

Clicking on the scheduler tab, the website takes me to /openemr . I attempted a few default credentials on the login form, but they wouldn’t work.

image-20260128193433129

After identifying the /openemr directory, I performed a directory brute-force attack using Gobuster, which revealed several interesting files and subdirectories.

/openemr/admin.php reveals that the actual version of installed OpenEMR is 5.0.1

image-20260128193445046

However, it appeared that all of the exploits required valid credentials which I do not have at the moment.

I suspected this might be a rabbit hole so I circled back to gobuster and performed directory brute forcing on the root path / .

In /filemanager , there were two shares: Images and Documents.

image-20260128193456896

I attempted to upload a reverse shell payload file but the server appears to be blocking .php file extension.

image-20260128193504175

But accepting .pdf

image-20260128193511490

I discovered the version of the filemanager: v.9.13.4

image-20260128193521544

Serachsploit was able to locate and return some known vulnerabilities to the version.

Looks like the exploit is working properly.

I attempted to read /openemr/sites/default/sqlconf.php but it didn’t work. I suspect it might be the .php file extension that the exploit can’t read.

image-20260128193531696

Inside the code, I made a few small edits so our exploit can read .php files. If the file manager still doesn’t show the file, I’m going to visit the SMB share because we know the SMB share and the Documents folder in filemanager are sharing the same environment.

image-20260128193538974

The server is saying there are 4 files when I only see 3. Can it be sqlconf.php ? It’s there but just not showing up?

image-20260128193547243

I visited /docs and confirmed that sqlconf.php file is actually present.

I obtained what appears to be the credentials of the MySQL DB.

MySQL 3306

I was able to authenticate to the database server using the credentials.

openemer database is available.

Also secure_file_priv variable is empty, meaning we can try writing files as the last resort if we can’t find anything in the database.

I found admin user and its hashed password in the users_secure table.

Successfully cracked the hash.

With the username and cleartext password, I finally was able to authenticate to openemr .

image-20260128193600013

Now that I have valid credentials, I can use exploits that I discovered earlier via searchsploit. I couldn’t use those attacks before because all of them require authentication.

image-20260128193609935

all of the exploits utilize /openemr/portal path but portal is disabled in the website’s settings.

image-20260128193618875

Got the perfectly stabilized shell with penelope

image-20260128193626690

Found local.txt

Privilege Escalation

I tried admin’s password on root and it worked.

Found root.txt