Challenge 0 (Secura) — OSCP Challenge Lab (192.168.244.97)

Multi-host OSCP-style challenge lab. Domain: secura.yzx.

#offsec / oscp#offsec#walkthrough#boxes#os:windows#tech:active-directory#tech:sqli#tech:rce

Challenge 0 (Secura) — OSCP Challenge Lab (192.168.244.97)

Multi-host OSCP-style challenge lab. Domain: secura.yzx.

Port Enumeration - DC1 (192.168.244.97)

🐺 howlsec@kalishell

$53/tcp    open  domain       Simple DNS Plus
$88/tcp    open  kerberos-sec Microsoft Windows Kerberos
$135/139/445  msrpc / netbios / microsoft-ds (Windows Server 2016 Standard 14393, workgroup SECURA)
$389/3268  ldap  Microsoft Windows Active Directory LDAP (Domain: secura.yzx)
$464/593/636/3269  kpasswd / ncacn_http / ldaps
$5985/tcp  open  http  Microsoft HTTPAPI 2.0 (WinRM)
$9389/tcp  open  mc-nmf

Port Enumeration - VM3 (192.168.244.95)

🐺 howlsec@kalishell

$135/139/445  msrpc / netbios / microsoft-ds
$3389/tcp  open  ms-wbt-server (SECURE.secura.yzx, Windows 10.0.19041)
$5001/tcp  open  commplex-link
$5985/tcp  open  http (WinRM)
$8443/tcp  open  ssl/https-alt  AppManager (ManageEngine Applications Manager / WebNMS / ZOHO)
$12000/tcp open  cce4x
$44444/tcp open  cognex-dataman (ManageEngine Applications Manager web UI)
$47001/tcp open  http
$57091/tcp open  java-rmi
$62673/62674 open  (Kerberos/SMB probe close_session)

The standout service is ManageEngine Applications Manager (8443 / 44444) on VM3 — a product with well-known authenticated/unauthenticated RCE and SQL injection CVEs, making it the intended foothold before pivoting through the secura.yzx domain.