[dzhino]

Hello, I have just started using kali linux and this interesting Nikto thing.
I've run a scan with nikto and it has found some vulnerabilities I suppose, can you please help me analyse and exploit these ?
(Site is owned by my friend which has authorized me to try to hack it, for patching purposes)

For me most interesting one seems to be "//********/cgi-bin/echo.bat?&dir+c:\\: This batch file may allow attackers to execute remote commands."

+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=change_adminpass: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=change_automail: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=colors: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-12184: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-134: /cgi-bin/pfdisplay.cgi?../../../../../../etc/passwd: Comes with IRIX 6.2-6.4; allows to run arbitrary commands

[CyberStrike]

Have you googled these plugins or OSVDB ? Literally first link has a set of commands you can use with RNN Guestbook 1.2 . As of OSVDB-134 looks like an LFI I suggest you take sometime and get familiar with things.

[Hackin]

Hello, I have just started using kali linux and this interesting Nikto thing.
I've run a scan with nikto and it has found some vulnerabilities I suppose, can you please help me analyse and exploit these ?
(Site is owned by my friend which has authorized me to try to hack it, for patching purposes)

For me most interesting one seems to be "//********/cgi-bin/echo.bat?&dir+c:\\: This batch file may allow attackers to execute remote commands."

+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=change_adminpass: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=change_automail: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=colors: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200
+ OSVDB-12184: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
+ OSVDB-134: /cgi-bin/pfdisplay.cgi?../../../../../../etc/passwd: Comes with IRIX 6.2-6.4; allows to run arbitrary commands

It literally tells you what you can do in it the logs. "+ OSVDB-2873: //*/cgi-bin/gbadmin.cgi?action=colors: RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200". Its telling you to try the default credentials... I'd recommend what the user above me said.

[dzhino]

Thank you very much for responses , what about this one ?
"//********/cgi-bin/echo.bat?&dir+c:\\: This batch file may allow attackers to execute remote commands."

[๖ۣۜCriminal]

Thank you very much for responses , what about this one ?
"//********/cgi-bin/echo.bat?&dir+c:\\: This batch file may allow attackers to execute remote commands."

Looks like LFI, if you want to audit third party libs/code snippets just install cgi-bin on localhost and that bat file and open it in notepad and trace user input into tainted functions that you as an attacker can abuse, static analysis can get you a long way but it's only possible if the project is open source, closed sourced projects are trickier to audit since you have to black box everything.