Omni
Gaining Access
Nmap scan:
Port 8080
Port 8080 requires credentials to access:
I did a detailed scan on port 8080, and found that it was running Windows Device Portal:
Windows Device Portal is related to IoT devices and it allows users to configure devices using it.
So Googling for Windows Device Portal exploits led me to this:
It seems that this is a Remote Access Trojan script that can be used to achieve RCE on the machine. I tested it using powershell -c ipconfig, and it worked well.
We can use this to gain a reverse shell easily using nc.exe. This reverse shell would give us a SYSTEM shell, which is unique because we are already the administrator.
User Flag
When trying to read the user flag, this is what we get:
The usage of PSCredential there means that the flag has been encrypted with the user's password. Since we are the SYSTEM user, what we can do is copy over the security, sam and system registry folders and use secretsdump.py on it.
This would give us a load of hashes. We can then use john to crack the hash for app, and find that it is mesh5143. Since we have the password, we can decrypt this to get the flag.
Privilege Escalation
The administrator flag was also encrytped using the same method, so we have to find the administrator password. We can do the same thing to get the administrator flag.
Weird machine, but I do appreciate the unique flags.