nitesh@gupta
Offensive Security Proving Grounds

Proving Grounds Windows Writeups

Windows boxes: SMB and web enumeration, public exploits, token and service abuse, and privilege escalation to SYSTEM.

boxes 17CVEs covered 1

Windows boxes

17 boxes
AlgernonWindows

Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.

21/ftp80/http135/msrpc139/netbios-ssn
AuthbyWindows

Enumeration across 21/ftp, 242/http, 3145/zftp-admin, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.

21/ftp242/http3145/zftp-admin3389/ms-wbt-server
CraftWindows

Enumeration across 80/http. Foothold to root using evil-winrm, kerberoasting, winpeas.

80/http
DVR4Windows

Enumeration across 22/ssh, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8080/http-proxy. Foothold to root using evil-winrm, kerberoasting, winpeas.

22/ssh135/msrpc139/netbios-ssn445/microsoft-ds?
HepetWindows

Enumeration across 25/smtp, 79/finger, 105/ph-addressbook, 106/pop3pw, 110/pop3. Foothold to root using evil-winrm, kerberoasting, winpeas.

25/smtp79/finger105/ph-addressbook106/pop3pw
HUTCHWindows

Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, winpeas.

53/domain80/http88/kerberos-sec135/msrpc
InternalWindows

Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.

53/domain135/msrpc139/netbios-ssn445/microsoft-ds
JackoWindows

Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 8082/http. Foothold to root using evil-winrm, kerberoasting, winpeas.

80/http135/msrpc139/netbios-ssn445/microsoft-ds?
KevinWindows

Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.

80/http135/msrpc139/netbios-ssn445/microsoft-ds
MedjedWindows

Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 5040/unknown, 8000/http-alt. Foothold to root using evil-winrm, kerberoasting, winpeas.

135/msrpc139/netbios-ssn445/microsoft-ds?5040/unknown
MiceWindows

Enumeration across 1978/remotemouse, 1980/pearldoc-xact?, 7680/pando-pub?. Foothold to root using evil-winrm, kerberoasting, winpeas.

1978/remotemouse1980/pearldoc-xact?7680/pando-pub?
MonsterWindows

Enumeration across 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.

80/http135/msrpc139/netbios-ssn443/ssl/http
NickelWindows

Enumeration across 21/ftp, 22/ssh, 80/tcpwrapped, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.

21/ftp22/ssh80/tcpwrapped139/netbios-ssn
ResourcedWindows

Enumeration across 53/domain, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn, 389/ldap. Foothold to root using evil-winrm, impacket, secretsdump.

53/domain88/kerberos-sec135/msrpc139/netbios-ssn
ShenziWindows

Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 443/ssl/http. Exploits CVE-2015-4133. Foothold to root using evil-winrm, kerberoasting, winpeas.

21/ftp80/http135/msrpc139/netbios-ssnCVE-2015-4133
SlortWindows

Enumeration across 21/ftp, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 4443/http. Foothold to root using evil-winrm, kerberoasting, winpeas.

21/ftp135/msrpc139/netbios-ssn445/microsoft-ds?
SquidWindows

Enumeration across 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?, 49666/msrpc, 49667/msrpc. Foothold to root using evil-winrm, kerberoasting, winpeas.

135/msrpc139/netbios-ssn445/microsoft-ds?49666/msrpc