search

Slort

hashtag
Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.233.53 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-30 21:12 +08
Nmap scan report for 192.168.233.53
Host is up (0.17s latency).
Not shown: 65520 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
4443/tcp  open  pharos
5040/tcp  open  unknown
7680/tcp  open  pando-pub
8080/tcp  open  http-proxy
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

hashtag
FTP Anonymous Fail

Does not allow anonymous logins.

hashtag
RFI -> User Shell

Port 4443 and 8080 host the same service:

I ran a gobuster scan on the site and found a few directories:

The /site directory contained a basic corporate page, but the most interesting part was the URL:

This looks like it's vulnerable to a file inclusion exploit. I tested this and it is RFI for this case:

We can grab a PHP Reverse shell for Windows from this page:

Logowindows-php-reverse-shell/Reverse Shell.php at master · Dhayalanb/windows-php-reverse-shellGitHubchevron-right

Afterwards, we just need to execute it:

We can then grab the user flag.

hashtag
Privilege Escalation

hashtag
Cronjob -> SYSTEM Shell

The C:\ directory contained a Backup folder that looked interesting:

info.txt basically told us what to do:

We can modify the TFTP.EXE file and replace it with our own reverse shell to get a SYSTEM shell after the scheduled task executes.

After a few minutes, the task would execute and give us a administrator reverse shell.

Rooted!

PreviousShenziNextSquid

Last updated