Fuse | Libertyunix

Last updated 4 years ago

Lets start with a Nmap Scan:

Take notice to the domain :

Its at this point with most HTB Machines that I'll add the hostname to /etc/hosts

Now lets enumerate the box with SMBClient & Enum4Linux:

Now lets take a port 80. After adding our host's FQDN to our /etc/hosts file we should get this page:

After downloading and grepping the cvs files we now have the following usernames:

Lets make a simple word list to accompany our newly found users. We can do this using cewl. CeWL is a tool which spiders a given URL to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper.

To check these credentials against the SMB service using Metasploit:

Using this module we discover we have working creds!!!

Lets circle back on our enumeration now that we have working creds!

These creds worked in the metasploit module why arent they are working now? Just just go with the error message and change the password. We can to this with smbpasswd:

So there is a password policy enforced so I changed my password to Fabricorp02:

Tried connecting over powershell but wasn't getting anywhere so I moved on to using rpcclinet, another great tool for enumeration.

Lets take note to the new users we have discovered:

After running through most of the enumeration commands I came across this gem:

WE have now have another credential!

Since psh is out the window let use evil-winrm:

We can use these credentials to grab the user flag:

Now that we access let grab a shell with netcat:

Lets begin our privilege escalation question with Windows Exploit Suggester - Next Generation (WES-NG) :

Or lets not.

Lets get a meterpreter shell up there while we are at it:

Next you'll want to create a resource file to quickly launch your handler:

We now have the ability to interact with the host via a netcat shell or a meterpreter session.

Now lets get back to our privilege escalation:

The article mentions these PoC codes

Lets download that and compile them on our Kali machine:

Now we can reconnect to our machine, upload the exploit and root the box:

Last updated 4 years ago