Slort
Gaining Access
Nmap scan:
$ nmap -p- --min-rate 4000 192.168.233.53
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-30 21:12 +08
Nmap scan report for 192.168.233.53
Host is up (0.17s latency).
Not shown: 65520 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3306/tcp open mysql
4443/tcp open pharos
5040/tcp open unknown
7680/tcp open pando-pub
8080/tcp open http-proxy
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49669/tcp open unknownFTP Anonymous Fail
Does not allow anonymous logins.
RFI -> User Shell
Port 4443 and 8080 host the same service:
I ran a gobuster scan on the site and found a few directories:
The /site directory contained a basic corporate page, but the most interesting part was the URL:
This looks like it's vulnerable to a file inclusion exploit. I tested this and it is RFI for this case:
We can grab a PHP Reverse shell for Windows from this page:
Afterwards, we just need to execute it:
We can then grab the user flag.
Privilege Escalation
Cronjob -> SYSTEM Shell
The C:\ directory contained a Backup folder that looked interesting:
info.txt basically told us what to do:
We can modify the TFTP.EXE file and replace it with our own reverse shell to get a SYSTEM shell after the scheduled task executes.
After a few minutes, the task would execute and give us a administrator reverse shell.
Rooted!
Last updated