Anthem
Exploit a Windows machine in this beginner level challenge
Hello hackers , my name is Molapo Manuel a security researcher and a bug bounty hunter.
let hunt down flags hacker.
Methodology :
Enumeration — Initial access — Privilege Escalation
Enumeration
From the nmap scan there are only two ports opened which is rdp(3389) and http(80)
Port 3389 is called remote desktop protocol this will allow to remote control of the windows machine.
Browsing through port 80 there is a website blog called Anthem.com.Through the application it revealed the poem author name James Orchard Halliwell can be it used?
I really do not know about.
Further enumeration which directory listing using dirsearch.Command
dirsearch -u http://<IP>
I found out interesting directories one is robots.txt
I found that CMS of the application which is umbraco .
What is the CMS ? CMS (Content Management Sytem) is software application that enables users to create, manage, modify, and publish digital content through a structured interface. CMS platforms typically use databases to store and organize website content, allowing developers and administrators to efficiently maintain websites without requiring extensive programming knowledge.
The enumeration of the webpage is done.The answers below are the result we got.To further explain more about the administrator name.The website revealed the admin wrote a poem .
Through googling the the author poem i found is Solomon Grundy.
TO retrieve the flags .They gave us clue that we are hiring might have flags so i navigated to the page source of we are hiring page.I found out two flags were hidden.
on the robots.txt we found out that there is a directory called /authors there is a flag.
Navigating to the a-cheers-to-our-it-department/ url viewing the page source there is a flag there hidden.
Initial Access
I used the the credential password and admin email to login in the CMS page.Found nothing but it validated my assumption whether the email and a password are true.
Since the rdp port is opened i logged in using the validated password.
xfreerdp /v:10.80.165.106 /u:SG /p:'UmbracoIsTheBest! ' /dynamic-resolution
After a successful login i found the the flag which user.txt
Privilege Escalation
Get vantaroot’s stories in your inbox
Join Medium for free to get updates from this writer.
To find the password for SG in windows.
Control Panel → System and Security → Appearance and Personalization → File Explorer Options → View → Show hidden files, folders, and drives → Apply
Step 2: Locate the Restricted File
The following path was accessed:
C:\backupInside the directory, a file named restore.txt was discovered. However, the SG user account initially did not have permission to access the file.
Step 3: Modify File Permissions
The file permissions were updated to grant the SG account read access:
- Right-click restore.txt → Properties
- Navigate to the Security tab
- Select Edit → Add
- Add the user account:
WIN-LU09299160F\SG
Confirm the permissions changes and apply the settings.
After updating the ACL permissions, the restore.txt file was opened successfully, revealing the Administrator password.
Backup Directory: Navigate to the hidden backup folder. Inside, you will find a restore.txt file that contains the administrator's password.
This PC\Local Disk (C:)\C:\backup\restore.txtAdministator password: ChangeMeBaby1MoreTime
Accessing the Administrator Password
After i obtained the necessary permissions, the following path was navigated:
This PC → Local Disk (C:) → Users → Administrator
This PC → Local Disk (C:) → Users → Administrator → Continue → Open "Administrator New Password" → Yes
When prompted, i selected to access the Administrator profile. The Administrator New Password file was then opened, and the displayed credentials were retrieved for use during the privilege escalation process.
This PC → Local Disk (C:) → Users → Administrator → Desktop → root
The root.txt file was located on the Administrator’s desktop. Opening the file revealed the final root flag.
