Nickel

Nmap output

Nmap scan report for 192.168.147.99
Host is up (0.058s latency).
Not shown: 65469 closed tcp ports (conn-refused)
PORT      STATE    SERVICE       VERSION
21/tcp    open     ftp           FileZilla ftpd 0.9.60 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
22/tcp    open     ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 86:84:fd:d5:43:27:05:cf:a7:f2:e9:e2:75:70:d5:f3 (RSA)
|   256 9c:93:cf:48:a9:4e:70:f4:60:de:e1:a9:c2:c0:b6:ff (ECDSA)
|_  256 00:4e:d7:3b:0f:9f:e3:74:4d:04:99:0b:b1:8b:de:a5 (ED25519)
56/tcp    filtered xns-auth
80/tcp    open     tcpwrapped
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open     microsoft-ds?
2513/tcp  filtered citrixadmin
3389/tcp  open     ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: NICKEL
|   NetBIOS_Domain_Name: NICKEL
|   NetBIOS_Computer_Name: NICKEL
|   DNS_Domain_Name: nickel
|   DNS_Computer_Name: nickel
|   Product_Version: 10.0.18362
|_  System_Time: 2025-10-22T17:22:19+00:00
|_ssl-date: 2025-10-22T17:23:26+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=nickel
| Issuer: commonName=nickel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-10-21T17:13:05
| Not valid after:  2026-04-22T17:13:05
| MD5:   48ae:51fa:d488:8cc7:917c:bd0d:5a44:48d3
|_SHA-1: f4ea:4bd9:dc9a:4939:be99:121b:cf23:6786:b485:1316
3715/tcp  filtered anoto-rendezv
5040/tcp  open     unknown
6073/tcp  filtered directplay8
6525/tcp  filtered unknown
7680/tcp  open     tcpwrapped
8089/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesn't have a title.
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-favicon: Unknown favicon MD5: 9D1EAD73E678FA2F51A70A933B0BF017
| http-methods: 
|_  Supported Methods: GET
8174/tcp  filtered unknown
12450/tcp filtered unknown
15053/tcp filtered unknown
16309/tcp filtered etb4j
16831/tcp filtered unknown
16844/tcp filtered unknown
17886/tcp filtered unknown
18656/tcp filtered unknown
19467/tcp filtered unknown
19642/tcp filtered unknown
19711/tcp filtered unknown
20208/tcp filtered unknown
22120/tcp filtered unknown
22598/tcp filtered unknown
28686/tcp filtered unknown
28970/tcp filtered unknown
29243/tcp filtered unknown
33333/tcp open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-methods: 
|_  Supported Methods: GET POST
|_http-favicon: Unknown favicon MD5: 76C5844B4ABE20F72AA23CBE15B2494E
|_http-title: Site doesn't have a title.
|_http-server-header: Microsoft-HTTPAPI/2.0
35021/tcp filtered unknown
36665/tcp filtered unknown
39594/tcp filtered unknown
41045/tcp filtered unknown
41379/tcp filtered unknown
43813/tcp filtered unknown
43953/tcp filtered unknown
45602/tcp filtered unknown
46287/tcp filtered unknown
47543/tcp filtered unknown
49664/tcp open     msrpc         Microsoft Windows RPC
49665/tcp open     msrpc         Microsoft Windows RPC
49666/tcp open     msrpc         Microsoft Windows RPC
49667/tcp open     msrpc         Microsoft Windows RPC
49668/tcp open     msrpc         Microsoft Windows RPC
49669/tcp open     msrpc         Microsoft Windows RPC
51016/tcp filtered unknown
51177/tcp filtered unknown
52074/tcp filtered unknown
53111/tcp filtered unknown
55034/tcp filtered unknown
55126/tcp filtered unknown
55143/tcp filtered unknown
55366/tcp filtered unknown
55658/tcp filtered unknown
56071/tcp filtered unknown
56793/tcp filtered unknown
58626/tcp filtered unknown
60259/tcp filtered unknown
60408/tcp filtered unknown
60563/tcp filtered unknown
61179/tcp filtered unknown
64307/tcp filtered unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

I wasn’t find anything interesting which was working on port 8089 & 33333. However on port and it says dev-api started

Which mean there’s an api here so I started trying different paths such as /api and got an error that incorrect parameter

Then I tried adding a parameter. But got the same error

Then I tried passing parameter to the webroot and we got some errror

After analyzing error It seems like we it’s executing on cmd so I tried ‘?whoami’ & got command execution as NT

Generated & downloaded reverse shell on machine

Ran the exe and got reverse shell as NT

Got local.txt (4c690ef6adcc759f2b57311e2229267b)

Got proof.txt (25c63426f185bc2e586d1198dc72e907)