Kevin

Nmap Scan

Foothold

I run my nmap scans in verbose mode so I can start working on any discovered port even before the scan is done, and as soon as i see SMB ports I start my usual spray with default credentials, this works sometimes but not this time

by now my nmap was done and I started by adding kevin to my /etc/hosts file.

Get dj4m’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Since I already checked SMB and know I need some credentials to get further which I don’t have now, I move to HTTP on port 80 and just by visiting the web app I already identified the app running and one extension used on the web pages

checking searchsploit I found and exploit (that is not Metasploit) so I give it a try

the exploit did not work but checking the code

Using that I login to the web app to dig further, I might have to modify the exploit to get it working but I won’t jump yet into that. I logged in and confirmed the application version to 4.2

then searching google leads back to same exploit

Exploit

I try modifying the shellcode, I was not sure how to generate the proper shell so I did some research and got some hints from the exploit itself

so the shell code was generated with Msf::Encoder::PexAlphaNum so I check msfvenom

now I know where to put the badchars from the exploit, I then check the encoding

now I know what encoding to use then for the format I will use c style to have a ready to copy paste array

I change the shellcode in the exploit, start my listener then run the exploit

I was able to get rev shell as system with access to proof.txt flag