bmdyy/tudo

TUDO - A vulnerable PHP Web Application.

TUDO (Vulnerable PHP Web-App)

MetaData

• Author: William Moody (@bmdyy)
• Started: 08.03.2021
• Languages: PHP, PostgreSQL
• Created as preparation for the OSWE/AWAE certification exam.

Goals

This is an intentionally vulnerable web application. There are 3 steps to complete the challenge, and multiple ways to complete each step.

1. You must gain access to either user1, or user2's account (2 possible ways)
2. Next, gain access to the admin account (1 possible ways)
3. Finally, find a way to remotely execute arbitrary commands (5 possible ways)

I would suggest to try and find every way to get the most out of TUDO. Bonus: Create a python script which chains together all 3 steps for a complete POC.

Note: The attack for step 2 may take up to a minute to complete, since the admin's actions are emulated with a cron job every minute on the target machine.

This is intended as a white-box penetration test, so open up VSCode, and read.

Default Credentials

• admin:admin
• user1:user1
• user2:user2

How to begin?

1. Clone the repo: git clone https://github.com/bmdyy/tudo.git
2. Go into the directory: cd tudo
3. Execute: ./RUNME.sh
4. Look in the terminal output and you should see an IP address: AH00558: apache2: ... 172.17.0.2 ...' That is the target!

Note: If you want to shutdown the container, you may use KILL.sh for convenience.

Note 2: I included SHELL.sh as a quick way to run a shell for the docker container

Solutions

There are explanations and solutions for all (intended) ways to solve this machine in /solution.

And finally, good luck!

tudo's Issues

geckodriver: error: Found argument '--websocket-port' which wasn't expected, or isn't valid in this context

The admin interaction simulation wasn't working for me.

In the container I had to modify /usr/local/lib/python3.7/dist-packages/selenium/webdriver/firefox/service.py by commenting out:

# Set a port for CDP
# self.service_args.append("--websocket-port")
# self.service_args.append("%d" % utils.free_port())

And change /app/emulate_admin.py:

driver = webdriver.Firefox(firefox_options=opts)

to

driver = webdriver.Firefox(options=opts)

Seems there's some kind of version conflict but I didn't look into it too closely.

Please add license

Disregard, sorry for wasting your time.

libapache2-mod-php7.3 Doesn't Exist in Debian 11

The current docker file fetches the latest version of Debian which at the time of writing is version 11, however version 11 doesn't have libapache2-mod-php7.3, whilst Debian 10 does. It would be advisable to lock this Docker container and other similar Docker containers for your other AWAE projects to Debian 10 since this seems to be the version they were developed against to prevent issues with dependencies.