## https://sploitus.com/exploit?id=171F2498-E11B-526C-A8A8-4B712108325B
# VAPT Report — Venus & Napping (X Company Engagement)
Vulnerability Assessment & Penetration Testing coursework for **Software Security (SENG 8414)** at Adventist University of Central Africa (AUCA). Two VulnHub machines, **Venus** and **Napping**, were tested end-to-end against a fictional client, "X Company," following a black-box methodology: recon → vulnerability assessment → exploitation → post-exploitation. Both hosts were compromised to root.
Full report: **[06_reporting/VAPT_Report_Final.pdf](06_reporting/VAPT_Report_Final.pdf)**
## Disclaimer
Venus and Napping are intentionally vulnerable VMs from [VulnHub](https://www.vulnhub.com/), built for practicing offensive security in an isolated environment. All testing here ran inside a local VirtualBox host-only lab network (`192.168.56.0/24`) — no real infrastructure, real company, or real person was targeted. "X Company" is a fictional client used for the coursework write-up. This repository is published for educational/portfolio purposes; the credentials, exploit code, and techniques shown target lab VMs designed to be broken.
## At a Glance
| Host | IP | Stack | Outcome |
|---|---|---|---|
| Venus | 192.168.56.4 | Custom Python WSGI app (port 8080) + SSH | Root, via CVE-2021-4034 (PwnKit) |
| Napping | 192.168.56.5 | Apache/PHP (port 80) + SSH | Root, via sudo/GTFOBins misconfiguration |
**8 findings confirmed** (2 Critical, 5 High, 2 Medium) — see the findings table in the report's Executive Summary.
## Attack Chain Summary
**Venus:** disclosed `guest:guest` credential on the login page → reverse-engineered the session cookie format (`base64(username:ROT13(password))`, no server-side signature check) → forged cookies to confirm valid usernames and bypass authentication → recovered `magellan`'s real SSH password by decoding a captured cookie → SSH shell as magellan → local root via CVE-2021-4034 (PwnKit, `pkexec` exploit).
**Napping:** reverse-tabnabbing phishing page (`window.opener.location` hijack) planted through the app's "submit a link for admin review" workflow → captured a real user's (daniel's) login credentials → SSH access as daniel → found a group-writable cron script (`/home/adrian/query.py`) and used it to get code execution as `adrian` → `sudo -l` revealed a NOPASSWD rule on `vim` → GTFOBins shell escape (`sudo vim -c ':!/bin/bash'`) → root.
## Repository Structure
```
01_Screenshots/ Visual evidence — logins, group membership, password discovery, root flags
02_recon/ nmap scans (ping sweep, TCP/UDP, service detail), enum4linux/snmp/nfs/smb checks,
gobuster/dirb/whatweb output, written recon summary
03_vulnscan/ searchsploit results, vulnerability testing (SQLi/SSTI/LFI), hardcoded credential
discovery, cookie forgery tests, admin panel checks
04_exploitation/ Reverse-tabnabbing PoC (evil.html/capture.php/fake-login.html), captured
credentials, cookie decoding, forged cookies and recovered passwords
05_post_exploit/ Logged terminal sessions for privilege escalation on both hosts
06_reporting/ Final report (Markdown, self-contained HTML, and PDF)
```
## Methodology
- **Recon:** `nmap` (ping sweep, top-1000, full TCP, UDP), `netdiscover`, `arp-scan`, `whatweb`, `gobuster`, `dirb`, `enum4linux`, `snmp-check`/`snmpwalk`.
- **Vulnerability assessment:** `searchsploit`, manual `curl` probing for source/git/backup disclosure, SQLi/SSTI/LFI testing, default-credential checks.
- **Exploitation:** manual cookie forgery and base64/ROT13 decoding, a self-hosted PHP reverse-tabnabbing capture page, `python3 -m http.server` for payload delivery.
- **Post-exploitation:** CVE-2021-4034 (PwnKit) compiled exploit on Venus; `sudo -l` enumeration and GTFOBins escape on Napping.
Full methodology, CVSS v3.1 scoring for every finding, remediation guidance, and a "tested, not exploitable" section (SSTI, SQLi, default creds, source/git/backup disclosure, Werkzeug debug, robots/sitemap, SMB/SNMP/NFS) are in the [full report](06_reporting/VAPT_Report_Final.pdf).
## Author
**Shema Christian** — Student ID 26991
Software Security (SENG 8414), Adventist University of Central Africa (AUCA)