Vulnerable-Lab-Exploitation

A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.

Vulnerable Lab Setup & PHP CGI Exploitation (CVE-2012-1823)

🎯 Project Overview

This project demonstrates the creation of an isolated virtual lab environment used to perform a full-spectrum penetration test. I simulated a real-world attack against an outdated Linux server, moving from network discovery to gaining unauthorized remote access.

🛠️ Tools & Technologies

• Hypervisor: VirtualBox
• Attacker OS: Kali Linux
• Victim OS: Metasploitable 2
• Networking: Virtual Host-Only Adapter (Isolated Sandbox)
• Tools Used: Nmap, Netcat, Metasploit Framework, Searchsploit

🚀 Execution Steps

1. Lab Architecture

I configured an isolated virtual network to ensure a safe testing environment. The lab consists of a Kali Linux machine and a Metasploitable 2 instance on a private subnet.

2. Reconnaissance

Using Nmap, I performed a service version scan to identify open ports: nmap -sV 192.168.**.***

• Finding: Port 80 was running an outdated version(over 15 years) of Apache 2.2.8 meaning it hasn't received security patches for modern threats. The Nmap result was Dav/2,its configured with WebDav that can sometimes allow attackers to upload or delete files if poorly detected.

3. Vulnerability Research

I used Searchsploit and the CVE database to identify CVE-2012-1823, a critical vulnerability in PHP-CGI that allows for Remote Code Execution (RCE). An older version of PHP that is vulnerable to RCE(Remote Code Execution).

4. Exploitation

Using the Metasploit Framework, I configured a reverse TCP handler:

• Module: exploit/multi/http/php_cgi_arg_injection
• Payload: php/meterpreter/reverse_tcp
• Result: Achieved a Meterpreter shell as www-data.

5. Post-Exploitation

I performed system enumeration and located sensitive configuration files containing plain-text database credentials in /var/www/.

🛡️ Remediation

To mitigate this vulnerability, the following actions are recommended:

1. Update PHP to the latest stable version (5.4.3+).
2. Configure the web server to block query strings starting with -d, -s, or -t.
3. Implement the principle of least privilege for the web-service user.