Posts for: #Windows

PG: AuthBy

#offsec  #proving-grounds  #medium  #windows  #ftp-anonymous  #htpasswd-crack  #php-webshell  #juicy-potato  #seimpersonate 
ターゲット // AuthBy
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.100.46

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE            VERSION
21/tcp   open  ftp                zFTPServer 6.0 build 2011-10-17
242/tcp  open  http               Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
3145/tcp open  zftp-admin         zFTPServer admin
3389/tcp open  ssl/ms-wbt-server?

Windows Server 2008 box. An ancient zFTPServer on 21, an HTTP app on the non-standard port 242 sitting behind HTTP Basic auth, the zFTPServer admin interface on 3145, and RDP on 3389. The name of the box is the hint: authentication is the whole game here.

[]

PG: Billyboss

#offsec  #proving-grounds  #medium  #windows  #nexus  #cve-2020-10199  #weak-credentials  #smbghost  #cve-2020-0796 
ターゲット // Billyboss
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.134.61

Enumeration

Nmap

The two ports that matter — a Nexus web service and SMB:

▶ Nmap output
PORT     STATE SERVICE       VERSION
445/tcp  open  microsoft-ds
8081/tcp open  http          Sonatype Nexus Repository Manager OSS 3.21.0-05

A Windows host with a web service on port 8081 — Sonatype Nexus Repository Manager OSS 3.21.0-05. SMB (445) is also exposed, which becomes relevant for privilege escalation later.

[]

PG: Internal

#offsec  #proving-grounds  #easy  #windows  #smb  #ms09-050  #metasploit 
ターゲット // Internal
PlatformOffSec Proving Grounds
OSWindows
DifficultyEasy
IP192.168.x.x

Enumeration

Nmap

The exposed surface is minimal — SMB is the only port in play:

▶ Nmap output
PORT    STATE SERVICE      VERSION
445/tcp open  microsoft-ds

An old Windows host exposing SMB. Post-exploitation sysinfo confirms the target: Windows Server 2008 (6.0 Build 6001, SP1), x86, workgroup member. That 32-bit architecture matters — it kills one of the two rabbit holes below.

[]

PG: Jacko

#offsec  #proving-grounds  #medium  #windows  #h2-database  #rce  #printspoofer  #seimpersonate  #credential-disclosure 
ターゲット // Jacko
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.89.66

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0 (redirects to H2 Database Engine)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
8082/tcp open  http          H2 database http console

Windows host. Port 80 redirects to an H2 Database Engine banner, and port 8082 serves the H2 web console directly. SMB (139/445) is present but gives nothing useful as an anonymous user.

[]

PG: MeatHead

#offsec  #proving-grounds  #hard  #windows  #ftp-anonymous  #password-cracking  #mssql  #xp-cmdshell  #seimpersonate  #printspoofer 
ターゲット // MeatHead
PlatformOffSec Proving Grounds
OSWindows
DifficultyHard
IP192.168.206.70

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1221/tcp open  ftp           Microsoft ftpd
1435/tcp open  ms-sql-s      Microsoft SQL Server 2017 14.00.1000.00; RTM
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (WinRM)

Windows Server 2019 box — the 445 fingerprint reads 2008 R2 - 2012, but that SMB banner is unreliable; systeminfo from the shell later confirms Server 2019. The interesting detail is the two services parked on non-standard ports: FTP on 1221 and MSSQL on 1435. IIS on 80 serves nothing useful, so the FTP is the way in.

[]

PG: UT99

#offsec  #proving-grounds  #medium  #windows  #irc  #unreal-tournament  #buffer-overflow  #seh  #unquoted-service-path 
ターゲット // UT99
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.206.44

Enumeration

Nmap

A full port sweep is deliberately noisy here — the box parks an InspIRCd instance on dozens of ports across the 6660-7007 range, enough to make autorecon choke. Trimmed to the services that actually matter:

▶ Nmap output
PORT      STATE SERVICE   VERSION
21/tcp    open  ftp       FileZilla ftpd
80/tcp    open  http      Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
443/tcp   open  ssl/http  Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
3306/tcp  open  mysql     MySQL (unauthorized)
6660-7007 open  irc       InspIRCd
64738/tcp open  murmur    Murmur 1.2.10

FTP wants credentials, MySQL refuses external connections, and the web app on 80/443 is a stock CMS with nothing exploitable after directory fuzzing. Everything obvious is a dead end. The name of the box — UT99 — plus the wall of IRC ports is the actual hint: this is about Unreal Tournament, and the IRC server is where the map lives.

[]

PG: Algernon

#offsec  #proving-grounds  #easy  #windows  #smartermail  #rce  #cve-2019-7214 
ターゲット // Algernon
PlatformOffSec Proving Grounds
OSWindows
DifficultyEasy
IP192.168.197.65

Enumeration

Nmap

▶ Full nmap output
21/tcp    open  ftp           Microsoft ftpd
80/tcp    open  http          Microsoft IIS httpd 10.0
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
5040/tcp  open  unknown
9998/tcp  open  http          Microsoft IIS httpd 10.0
17001/tcp open  remoting      MS .NET Remoting services

Port 21 - FTP

Anonymous access is allowed. Downloaded the FTP contents:

[]

PG: Nickel

#offsec  #proving-grounds  #medium  #windows  #api-enumeration  #curl  #pdf-cracking  #command-injection 
ターゲット // Nickel
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.57.99

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd
22/tcp    open  ssh           OpenSSH for_Windows_8.1
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0

Two HTTP APIs on non-standard ports. FTP requires credentials, no anonymous access.

[]

PG: Slort

#offsec  #proving-grounds  #medium  #windows  #lfi  #rfi  #php-wrapper  #scheduled-task  #xampp 
ターゲット // Slort
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.105.53

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     FileZilla ftpd 0.9.41 beta
135/tcp  open  msrpc   Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3306/tcp open  mysql   MariaDB (host not allowed)
4443/tcp open  http    Apache httpd 2.4.43 (XAMPP)
8080/tcp open  http    Apache httpd 2.4.43 (XAMPP)

Windows box running XAMPP on two HTTP ports (4443 and 8080); the vulnerable app lives on 8080, so 4443 stays untouched. FTP requires credentials, MySQL is localhost-only.

[]