Nickel

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.240.99     
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-07 14:39 +08
Nmap scan report for 192.168.240.99
Host is up (0.17s latency).
Not shown: 65518 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3389/tcp  open  ms-wbt-server
5040/tcp  open  unknown
7680/tcp  open  pando-pub
8089/tcp  open  unknown
33333/tcp open  dgi-serv
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

FTP doesn't accept anonymous logins and RDP is open for this machine.

Web Enumeration -> User Creds

Port 80 was weird:

Port 8089 was slightly weirder:

Clicking on any of these would send requests to an IP address on port 33333:

Meanwhile on port 33333, we needed a token of some sorts:

And this is all the information we have. I experimented with sending POST requests instead of GET requests, and it actually returned something from port 33333.

This was different from the Not Found errors. I changed around the directory it sent requests to, and the list-running-procs returned something interesting:

If we scroll down, we can see this:

This was a password for a user ariah, which works:

Privilege Escalation

FTP PDF -> Admin Shell

There was a C:\ftp directory that looked interesting:

We can transfer this back to our machine via smbserver.py and then view it.

There was a temporary command point, and I enumerated it from the machine:

It seems that we have a SYSTEM shell with this command endpoint. What we can do is just add ariah to the Administrators group.

Then, we can relogin and view the flag:

Rooted!

PreviousMedjedNextResourced

Last updated