Active
🔗 Active
Task 1 - Deploy the machine
🎯 Target IP: 10.10.10.5
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~128 secs. this indicates that the target is a Windows system, while *nix systems usually have a TTL of 64 secs.
2.1 - What is the name of the service is running on TCP port 21 on the target machine?
21 on the target machine?sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 2 open ports on the machine: 21, 80.
Now, we need to search which services are running on open ports, in details on port 21:
2.2 - Which basic FTP command can be used to upload a single file onto the server?
We can use put command to upload a single file.
2.3 - Are files put into the FTP root available via the webserver?
We can try to put a file using ftp, in this case we use nmap result file (port_scan):
2.4 - What file extension is executed as a script on this webserver? Don't include the ..
..2.5 - Which metasploit reconnaissance module can be used to list possible privilege escalation paths on a compromised system?
We launch msfconsole:
and we search a post/multi/recon exploit:
Task 3 - Find user flag
3.1 - Submit the flag located on the babis user's desktop.
Now, we can use msfvenom to generate an exploit to upload using ftp
LHOST is local ip, while, LPORT is the port that we'll use to connect by netcat.
Now we can launch netcat on port 444 and run script:
We're iis apppool\web user, the flag maybe is on the babiis user's desktop
We've not access to babibs' directory, we can try to find "user.txt" flag using while command in C:\ root.
Nothing to do! Now, we need to privilege escalation and access on bibis' dir.
We launch systeminfo command to know info about OS:
OS Version: 6.1.7600 N/A Build 7600
Searching on google we found this exploit for OS vs.
We download this script: "40564.c" and we compile it using mingw32
Now we can re-open ftp in binary mode and put it (exploit.exe)
We can find exploit.exe file using where command and run it to escalate privilege!
Starting to root folder (C:\) we can find quickly flags, using where command in recusive mode (/r):
and read user.txt flag using type command (equivalent to cat on *nix):
Task 4 - Find root flag
After that, we do the same thing for root.txt flag