search

BASTARD

Difficulty: Medium SO: Windows

hashtag
1-NMAP

We found a port 80 on which nmap directly shows us different directories:

hashtag
2-DRUPAL

As we can see drupal is being used, and we can see that there is a changelog.txt directory where we can find the version of it:

Changelog.txt

The version is 7.54, using the gobuster tool we also found a directory called rest with the following content:

Searching for information about this and drupal on searchsploit we found an exploit:

Modify the exploit as it has different routes and ip:

We put a simple cmd shell as payload, run the exploit:

hashtag
3-RCE

We can now execute commands and we are also nt authority, so we send us a PowerShell reverse shell:

We received the shell:

hashtag
4-PRIVILEGE ESCALATION

We see that the OS has an outdated version of windows 2008:

Searching for information we found a kernel exploit MS15-051:

LogoMicrosoft Windows - Local Privilege Escalation (MS15-051)Exploit Databasechevron-right

It leads to a pre-compiled exploit:

We download the .zip and extract the .exe, start an http server and download it to the victim machine:

We get privileges, so we are going to run a reverse shell:

We received the reverse shell:

PreviousPage

Last updated