# The Live Engagement

## Now Let’s Begin 🚀 <a href="#df44" id="df44"></a>

## Scenario:

CAT5's team has secured a foothold into Inlanefrieght's network for us. Our responsibility is to examine the results from the recon that was run, validate any info we deem necessary, research what can be seen, and choose which exploit, payloads, and shells will be used to control the targets

## Objectives:

* Demonstrate your knowledge of exploiting and receiving an interactive shell from a `Windows host or server`.
* Demonstrate your knowledge of exploiting and receiving an interactive shell from a `Linux host or server`.
* Demonstrate your knowledge of exploiting and receiving an interactive shell from a `Web application`.
* Demonstrate your ability to identify the `shell environment` you have access to as a user on the victim host.

## Credentials

The credentials we need for a foothold: **`htb-student`** / **`HTB_@cademy_stdnt!`**

## Targets

Host-01: 172.16.1.11&#x20;

Host-02: blog.inlanefreight.local&#x20;

Host-03: 172.16.1.13

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FISBxW4YXF6pO4IbPI66u%2FScreenshot.png?alt=media&#x26;token=a8656bc6-3008-4a9c-bfbb-f48f1913964b" alt=""><figcaption></figcaption></figure>

Initially, I established a connection utilizing xfreerdp with the provided credentials.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FrGseOHKKscdh6XqfZ99s%2FScreenshot(1).png?alt=media&#x26;token=bc22d34d-04a4-484b-ab10-067c55fb5915" alt=""><figcaption></figcaption></figure>

After establishing initial access with xfreerdp, I employed nmap to conduct a port scan on Host-01, revealing several open ports.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FMxkVozU3Tt45q8XvLMpZ%2FScreenshot(2).png?alt=media&#x26;token=d263a7b0-aa33-4a05-abbe-f802d38ec887" alt=""><figcaption></figcaption></figure>

1\) What is the hostname of Host-1?  **shells-winsvr**

I visited <http://172.16.1.11/> but found no useful information, so I took a look at /etc/hosts and I found **`status.inlanefreight.local`**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fc14cZT22y9mwrp56AOEf%2FScreenshot(4).png?alt=media&#x26;token=8e7292a7-b505-4700-9a03-6b67bb404a58" alt=""><figcaption></figcaption></figure>

Based on the nmap results, we identified the system as a Windows Server 2019. Subsequently, I utilized whatweb to determine the specific server software in order to generate a payload using msfvenom.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F1R1X3vSkG5arwqvOvD7l%2FScreenshot(6).png?alt=media&#x26;token=baaff554-f6f7-4ea0-9ad4-0ed8eb0bec80" alt=""><figcaption></figcaption></figure>

Based on the findings, the server currently in operation utilizes ASP.NET. Consequently, we shall proceed to generate our payload.

Let's aim to establish a shell. I utilized the Laudanum webshell available at the following link.

{% embed url="<https://github.com/jbarcia/Web-Shells/tree/master/laudanum>" %}

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FsEr85YTowdwlFLx264Bq%2FScreenshot(9).png?alt=media&#x26;token=de8938f3-a680-4b33-9bdc-2dbfbc050a33" alt=""><figcaption></figcaption></figure>

I included my IP address in the list of allowd IPs within the webshell file. Let's proceed with uploading the file to establish shell access.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FWRUKSdEa2IwgDWGDwTYZ%2FScreenshot(11).png?alt=media&#x26;token=de0563e3-a62f-48ba-aadc-020b65e0ab40" alt=""><figcaption></figcaption></figure>

We have successfully obtained a shell and can now access the folder located at C:\Shares.

Next up is the second host: **`blog.inlanefreight.local.`**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FrWV6jNcktNMt01eugl9t%2FScreenshot(12).png?alt=media&#x26;token=22dda844-dc05-4609-9504-9a0aa166e094" alt=""><figcaption></figcaption></figure>

Two ports, 22 and 80, are open. Upon accessing port 80, a post directing to an exploit named 50064. However, since this attack requires authentication, I conducted directory enumeration to gather additional information.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F60iFvoD1KOKQPMobyH0F%2FScreenshot(13).png?alt=media&#x26;token=52003782-341c-4e84-8bdb-89a545203f27" alt=""><figcaption></figcaption></figure>

After conducting directory enumeration, I discovered a directory labeled 'data.' Upon accessing it, I encountered a file named 'config.ini' which contain the necessary username and password for executing this attack.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FfifKzX0zXueTuzqquwR8%2FScreenshot(14).png?alt=media&#x26;token=ef39377c-3c73-447a-b595-7d4a7c6205ff" alt=""><figcaption></figcaption></figure>

I initially transferred the exploit to /usr/share/metasploit-framework/modules/exploits/ and subsequently successfully exploited the second target. You'll discover the flag located in the **`customscripts`** folder.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FqHtVPy5WVnpeQ6V5f9FR%2FScreenshot(15).png?alt=media&#x26;token=faacc12f-fd99-4f39-a044-803a4d726579" alt=""><figcaption></figcaption></figure>

What language is the shell written in that gets uploaded when using the 50064.rb exploit? **`php`**

Let's now investigate the third target: **`172.16.1.13`**

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FOebrlnc28rL2A0JR9hf4%2FScreenshot(16).png?alt=media&#x26;token=140a0ee6-8455-4168-94e6-d83845013eaf" alt=""><figcaption></figcaption></figure>

After conducting reconnaissance, I discovered that the server operates on Windows Server 2016 and utilizes the SMB protocol. Let's proceed with attempting to exploit it, as it may be vulnerable to EternalBlue.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fpk6UzbP0s8KW9r4MSRFj%2FScreenshot(17).png?alt=media&#x26;token=fc3c976d-db6a-417e-b946-c0bf6895ef48" alt=""><figcaption></figcaption></figure>

So the host is likely vulnerable to MS17-010, so let's exploit it.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FQlc8mC9fb5yH78Q910AU%2FScreenshot(18).png?alt=media&#x26;token=bc7e0d00-f0dc-4261-b550-3030d87f38cb" alt=""><figcaption></figcaption></figure>

You now have access to the flag. Thank you for taking the time to read this writeup. Wishing you a wonderful day ahead.
