Optimum

OS: Windows, Difficulty: Easy, IP: 10.10.10.8

Initial Enumeration

# Nmap 7.70 scan initiated Mon Jul 15 21:15:18 2019 as: nmap --min-parallelism 500 -p- -T5 -oN T-all 10.10.10.8
Nmap scan report for 10.10.10.8
Host is up (0.45s latency).
Not shown: 65534 filtered ports
PORT   STATE SERVICE
80/tcp open  http

# Nmap done at Mon Jul 15 21:17:01 2019 -- 1 IP address (1 host up) scanned in 102.76 seconds

Only port 80 was open.

Server - HTTP File Server (HFS)

There's a RCE MSF module.

User Own

Root Own

Used this tool to get exploit suggestions

LogoGitHub - strozfriedberg/Windows-Exploit-Suggester: This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.GitHub

Exploit MS16-098 worked for me using the following repository

Logowindows-kernel-exploits/MS16-098 at master · SecWiki/windows-kernel-exploitsGitHub

Learning Outcome

Try different windows exploit suggester rather than sticking to the Meterpreter one. I tried with the default one in MSF, and it did not suggest anything good.

EDIT: Learn to migrate to x64 bit Shell if the box is 64bit as I missed one exploit due to not migrating to 64bit.

PreviousLegacyNextArctic

Last updated

Was this helpful?