For the complete documentation index, see llms.txt. This page is also available as Markdown.

Prison Management System

Prison Management System exposed over HTTPS can allow authenticated PHP file upload RCE through the administrator photo upload workflow.

Discovery

The SSL certificate may reveal the hostname:

Subject: commonName=vmdak.local/organizationName=PrisonManagement
Subject Alternative Name: DNS:vmdak.local

Useful enumerated directories:

/css/
/image/
/images/
/inc/
/js/
/lib/

Authentication

The admin login is at:

https://vmdak.local:9443/Admin/login.php

Valid admin credentials:

admin:admin123

SQL injection also authenticated successfully:

Authenticated File Upload RCE

The administrator photo upload endpoint is:

Prepare a PHP reverse shell:

Upload it as an image, intercept the upload request in Burp, and change the uploaded filename from shell.jpg to shell.php before forwarding it.

Trigger the uploaded shell:

Successful shell:

Database Credentials

From the web root, search for database connection files:

Useful values:

Connect locally:

Useful database enumeration:

References

  • https://www.exploit-db.com/exploits/52017

  • https://www.rapid7.com/db/modules/exploit/linux/http/prison_management_rce/

Last updated