## https://sploitus.com/exploit?id=7E7A06DE-CA01-5692-BE7E-73B7F1C1DE43
# PwnOS2 Linux Web Pentest
Authorized penetration-testing case study against the PwnOS2 vulnerable Linux lab.
The assessment demonstrates a realistic attack path from external reconnaissance to
root-level compromise through weaknesses in a legacy PHP web application and
insecure credential handling.
> This project was performed only in an isolated, authorized laboratory environment.
> Do not test these techniques against systems without explicit permission.
## Objectives
- Identify exposed network services.
- Enumerate the hosted web applications and directories.
- Assess the security posture of SimplePHPBlog 0.4.0.
- Demonstrate the impact of unsafe file-upload functionality.
- Establish the resulting web-server access in a controlled lab.
- Identify credential exposure and assess privilege-escalation risk.
- Document detection and remediation recommendations.
## Environment
- Target: PwnOS2 vulnerable Linux virtual machine
- Network: Isolated private lab network
- Services observed: SSH and HTTP
- Web server: Apache HTTP Server 2.2.17
- Web application: SimplePHPBlog 0.4.0
- Assessment tools: Nmap, DIRB, Searchsploit, Netcat, standard Linux utilities
Exact IP addresses, host fingerprints, credentials, and sensitive output have been
redacted from this repository.
## Attack Path
1. Enumerated the target host and identified SSH and HTTP services.
2. Discovered web directories and application entry points.
3. Fingerprinted SimplePHPBlog 0.4.0.
4. Correlated the application version with publicly documented vulnerabilities.
5. Demonstrated unauthorized modification of application authentication data in the lab.
6. Used the resulting authenticated access to test unsafe file-upload behavior.
7. Obtained a controlled shell as the web-server account.
8. Identified database credentials stored in an exposed local PHP configuration file.
9. Validated the impact of credential reuse by obtaining root access in the lab.
## Findings
| ID | Finding | Severity |
|---|---|---|
| F-01 | Unsupported legacy web application with multiple known vulnerabilities | Critical |
| F-02 | Unrestricted file upload enabling server-side code execution | Critical |
| F-03 | Sensitive database credentials stored in readable application files | High |
| F-04 | Credential reuse enabling privilege escalation | Critical |
| F-05 | Missing secure cookie configuration | Low |
## Skills Demonstrated
- Network reconnaissance
- Service and technology enumeration
- Web-content discovery
- Vulnerability research
- Exploit-chain analysis
- Controlled post-exploitation
- Credential exposure analysis
- Linux privilege-escalation assessment
- Security reporting
- Defensive detection and mitigation planning
## Repository Contents
- `METHODOLOGY.md` — assessment process and scope.
- `REPORT.md` — sanitized technical findings and impact analysis.
- `DETECTION-AND-MITIGATION.md` — defensive recommendations and detection ideas.
- `REFERENCES.md` — external vulnerability references.
## Ethics
This repository documents authorized lab testing for educational and professional
security research. The techniques must not be used against systems without written
permission.