BillyBoss

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.175.61 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-01 20:35 +08
Nmap scan report for 192.168.175.61
Host is up (0.17s latency).
Not shown: 65521 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
5040/tcp  open  unknown
7680/tcp  open  pando-pub
8081/tcp  open  blackice-icecap
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

To avoid making this long:

  • FTP was not interesting because anonymous access isn't allowed and guessing credentials is pointless.

  • Port 80 had some application that wasn't working properly.

  • SMB did not accept null credentials and had nothing there.

  • The rest of the ports were pretty useless.

Default Creds -> Nexus RCE

Port 8081 had a Nexus Repository Manager that was running:

To exploit this, we first need to guess the credentials to login. nexus:nexus works for this one. Then, we need to grab the correct exploit:

Edit the exploit accordingly:

Then, we can

Then, we can execute the script once to download nc.exe onto the machine, and another to execute nc.exe to get a reverse shell:

Privilege Escalation

SeImpersonatePrivilege -> Admin Shell

The user has SeImpersonatePrivilege enabled:

However, PrintSpoofer.exe wasn't working normally, so we probably need to use another method. Instead, we can use GodPotato.exe to do this:

LogoReleases · BeichenDream/GodPotatoGitHub

For some reason, this user was unable to run whoami, so I just captured the flag instead:

PreviousAuthByNextButch

Last updated