Exercise 40: Server Misconfiguration – Default Credentials and Admin Interfaces

Objective

Learn how to exploit Server Misconfigurations related to default credentials and exposed administrative interfaces to gain unauthorized access. Understand how to secure server configurations by changing default credentials, disabling unused services, and implementing multi-factor authentication.

---

Scenario

You are assessing a web server hosting an administrative interface that uses default credentials (e.g., admin:admin). Due to improper configuration, the admin panel is exposed to the public, allowing attackers to gain unauthorized access.

---

Lab Setup

Prerequisites:

• Basic knowledge of server management and web applications.
• XAMPP/LAMP/WAMP stack installed (or any web server with PHP support).
• Tools like Burp Suite or browser developer tools for testing.

Step 1: Create the Vulnerable Application

1. Admin Login Interface (Vulnerable)
   • Create a file admin_login.php: <?php session_start(); $default_username = 'admin'; $default_password = 'admin'; if (isset($_POST['login'])) { $username = $_POST['username']; $password = $_POST['password']; if ($username === $default_username && $password === $default_password) { $_SESSION['admin'] = true; header("Location: admin_panel.php"); } else { echo "<h3>Invalid Credentials!</h3>"; } } ?> <h2>Admin Login</h2> <form method="POST" action=""> Username: <input type="text" name="username" required><br> Password: <input type="password" name="password" required><br> <button type="submit" name="login">Login</button> </form>
2. Admin Panel Interface
   • Create a file admin_panel.php: <?php session_start(); if (!isset($_SESSION['admin'])) { header("Location: admin_login.php"); exit(); } echo "<h2>Welcome to the Admin Panel!</h2>"; ?>
3. Running the Application
   • Start the Apache server.
   • Place admin_login.php and admin_panel.php in the web server’s root directory (htdocs for XAMPP).
   • Open http://localhost/admin_login.php in your browser.

---

Exploitation Steps

Step 1: Accessing the Admin Panel with Default Credentials

1. Navigate to http://localhost/admin_login.php.
2. Enter the following credentials:
   • Username: admin
   • Password: admin
3. Click Login.

Expected Result:

• The attacker successfully gains access to the admin panel without any resistance.

Step 2: Discovering Exposed Admin Interfaces

1. Use search engines with queries like: inurl:/admin_login.php intitle:"Admin Login"
2. Expected Result:
   • Publicly exposed admin interfaces are indexed and discoverable.

---

Solution and Prevention

Problem Analysis

• The admin interface uses weak default credentials and is publicly accessible.

Fixing the Vulnerability

1. Change Default Credentials
   • Enforce strong, unique passwords for all accounts: $hashed_password = password_hash("StrongPassword123!", PASSWORD_BCRYPT);
2. Restrict Access to Admin Interfaces
   • Restrict access to trusted IPs only: <Directory "/path/to/admin"> Require ip 192.168.1.100 </Directory>
3. Implement Multi-Factor Authentication (MFA)
   • Require an additional layer of verification beyond a password.
4. Disable Unused Services and Interfaces
   • Remove or disable unnecessary admin interfaces and services.
5. Use Security Headers
   • Prevent directory browsing: Options -Indexes
6. Regularly Update and Patch Systems
   • Keep all software and services updated.

---

Testing After Fix

1. Attempt to log in using admin:admin.
2. Expected Result:
   • The server rejects the default credentials.
3. Try accessing the admin page from an unauthorized IP.
4. Expected Result:
   • Access is denied due to IP restrictions.

---

Conclusion

In this lab, you exploited Server Misconfiguration by using default credentials to gain unauthorized access. You also learned how to mitigate this vulnerability by changing default credentials, restricting access, enabling MFA, and disabling unused services.