$ nmap -p- --min-rate 4000 -Pn 192.168.201.43
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-08 14:37 +08
Nmap scan report for 192.168.201.43
Host is up (0.17s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
8080/tcp open http-proxy
RDP is available.
ManageEngine RCE -> SYSTEM
Port 8080 hosts a really vulnerable looking software:
Default creds of administrator:administrator works in logging us in:
There are loads of vulnerabilities with this software.
I was lazy, so I used msfconsole to exploit this easily.
This would give us a Meterpreter shell as the SYSTEM user:
