> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/medjed/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/medjed/enumeration/web-services/8000.md).

# 8000

Barracuda Storage Server running 6.5.

I tried to enumerate this CMS and possibly get a shell since at some point I had Admin and write access to the /fs/ folder. 

After setting up the administrator account for the CMS. ![](https://77507245-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFBsiDeuhN5SJcOCFJbtD%2Fuploads%2F3YECGDiF2A4GFMDJ6mIy%2F2022-07-12_21-33.png?alt=media\&token=24b8854f-e0fd-40bd-a071-3f063d8a7601)

I noticed that the application was speaking in lsp rather than php or asp or aspx. 

I tried grabbing a lsp reverse shell on this little dashboard but I was still unable to. ![](https://77507245-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFBsiDeuhN5SJcOCFJbtD%2Fuploads%2FBQUR1vUtTVCi9F889Rp1%2F2022-07-12_21-31.png?alt=media\&token=50936879-f698-4058-98c0-f899cf95d643)

I think by this time I started to get a little bit frustrated since I was not able to come up with anything else. I believe this was a rabbit hole inteded to drain time. I think I will benefit in setting up a timer in enumerating certain websites or services. I will say "I will dedicate 20 minutes per exploit, if it does not work, it means it was not the intended way."

Moreover I was able to find a notable exploit for the future once I gain foothold. 

{% embed url="<https://www.exploit-db.com/exploits/48789>" %}

This exploit has insecure file permissions which means that I am able to overwrite it with a malicious .exe payload and upon restarting the application I will be able to get a shell as the administrator.&#x20;