PG: MeatHead

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // MeatHead
Platform	OffSec Proving Grounds
OS	Windows
Difficulty	Hard
IP	`192.168.206.70`

Enumeration

Nmap

▶ Nmap output

PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1221/tcp open ftp Microsoft ftpd
1435/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
3389/tcp open ms-wbt-server Microsoft Terminal Services
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (WinRM)

Windows Server 2019 box — the 445 fingerprint reads 2008 R2 - 2012, but that SMB banner is unreliable; systeminfo from the shell later confirms Server 2019. The interesting detail is the two services parked on non-standard ports: FTP on 1221 and MSSQL on 1435. IIS on 80 serves nothing useful, so the FTP is the way in.

Password-Cracking on ioctl

PG: MeatHead

Enumeration

Nmap