> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/wreath-try-hack-me/pivoting/10.200.101.100/exploit.md).

# Exploit

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2Fe3FB02SZYBMxq414TVGQ%2Fimage.png?alt=media&amp;token=c0a67967-670c-4925-b1f7-9e7fbc464ef5" alt=""><figcaption></figcaption></figure>

Use previously discovered credentials

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2F6F3jlO4omjOwdsRYmT5F%2Fimage.png?alt=media&amp;token=e02b8dc0-c1c5-4a1c-b0ac-128ab774512a" alt=""><figcaption></figcaption></figure>

Add PHP shell code to image

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2F14VK92Mu2noIab3HJ6eJ%2Fimage.png?alt=media&amp;token=a4593651-d616-41c4-8df3-51f7d299e7be" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FOX2ghLRwgWahAj2ZIhGo%2Fimage.png?alt=media&amp;token=c5e4f6eb-9bd9-405e-9863-a4dbd8c7a9e0" alt=""><figcaption><p>SHELL CODE IS POSSIBLE</p></figcaption></figure>

## Obfuscation

{% embed url="<https://www.gaijin.at/en/tools/php-obfuscator#result>" %}

Obfuscate php code and upload payload

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FK5bNoYJO0NBSXl2SAZ9v%2Fimage.png?alt=media&amp;token=2b23d7b0-e1b8-459c-ad0b-038f214917eb" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2F0DPmrODYoxjhQhLQlG4p%2Fimage.png?alt=media&amp;token=42e27e7e-0ae2-494b-a5e1-3cd25fd477c5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2Fsb5HIRWvleelsAbFsH2R%2Fimage.png?alt=media&amp;token=aa1aa5c0-0e34-43bc-a340-ed28edf43019" alt=""><figcaption></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FNvnisKYda5azUwiPEFCK%2Fimage.png?alt=media&amp;token=d71368c9-481a-47b9-8348-957224674478" alt=""><figcaption></figcaption></figure>