search

windowsShenzi

hashtag
Enumeration:

hashtag
Port Scanning:

┌──(kali㉿kali)-[~/…/Machines/OffsecPG/Practice/Shenzi]
└─$ sudo nmap -sCV -p- --min-rate 4000 -oA nmap/services -vv 192.168.203.55
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-14 01:23 EST
Nmap scan report for 192.168.203.55                                                                                                                                         
Host is up, received echo-reply ttl 125 (0.21s latency).                                                                                                                    
Scanned at 2025-11-14 01:24:00 EST for 202s                                           
Not shown: 65520 closed tcp ports (reset)                                                                                                                                   
PORT      STATE SERVICE       REASON          VERSION                                                                                                                       
21/tcp    open  ftp           syn-ack ttl 125 FileZilla ftpd 0.9.41 beta                                                                                                    
| ftp-syst:                                                                           
|_  SYST: UNIX emulated by FileZilla                                                                                                                                        
80/tcp    open  http          syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)                                                                        
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6                  
| http-title: Welcome to XAMPP                                                        
|_Requested resource was http://192.168.203.55/dashboard/                                                                                                                   
|_http-favicon: Unknown favicon MD5: 56F7C04657931F2D0B79371B2D6E9820                                                                                                       
| http-methods:                                                                                                                                                             
|_  Supported Methods: GET HEAD POST OPTIONS                                          
135/tcp   open  msrpc         syn-ack ttl 125 Microsoft Windows RPC                                                                                                         
139/tcp   open  netbios-ssn   syn-ack ttl 125 Microsoft Windows netbios-ssn                                                                                                 
443/tcp   open  ssl/http      syn-ack ttl 125 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)                                                                        
| http-title: Welcome to XAMPP                                                        
|_Requested resource was https://192.168.203.55/dashboard/                                                                                                                  
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6                  
| http-methods:                                                                                                                                                             
|_  Supported Methods: GET HEAD POST OPTIONS                                          
| tls-alpn:                                                                                                                                                                 
|_  http/1.1                                                                                                                                                                
|_http-favicon: Unknown favicon MD5: 6EB4A43CB64C97F76562AF703893C8FD                                                                                                       
| ssl-cert: Subject: commonName=localhost                                             
| Issuer: commonName=localhost                                                                                                                                              
| Public Key type: rsa                                                                                                                                                      
| Public Key bits: 1024                                                               
| Signature Algorithm: sha1WithRSAEncryption                                          
| Not valid before: 2009-11-10T23:48:47                                                                                                                                     
| Not valid after:  2019-11-08T23:48:47                                                                                                                                     
| MD5:   a0a4:4cc9:9e84:b26f:9e63:9f9e:d229:dee0                                                                                                                            
| SHA-1: b023:8c54:7a90:5bfa:119c:4e8b:acca:eacf:3649:1ff6                            
| -----BEGIN CERTIFICATE-----                                                                                                                                               
| MIIBnzCCAQgCCQC1x1LJh4G1AzANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwls
<snipped>
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds? syn-ack ttl 125
3306/tcp  open  mysql         syn-ack ttl 125 MariaDB 10.3.24 or later (unauthorized)
5040/tcp  open  unknown       syn-ack ttl 125
7680/tcp  open  pando-pub?    syn-ack ttl 125
49664/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 125 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

<snipped>

We have multiple open ports, we will play with them one by one.

hashtag
FTP (21):

I could not authenticate as anonymous user.

hashtag
SMB (445):

We do not have null session authentication, but:

We do have guest authentication.

Enumerate the shares:

We have read access to a non-default share named shenzi.

Via smbclient we can authenticate see what files are there, and download if any.

Non of the files were interesting except for that one:

We have a set of credentials that seems to be for the admin on wordpress.

hashtag
HTTP (80):

We were welcomed with the xampp default page.

I will run gobuster to discover hidden directories:

I tried a couple of wordlists with no further results.

Then I went back to offsec portal, and unloacked one of the hints:

It says we should guess the root directory of wordpress website.

Sometimes offsec's uses the machine names in a lot of places like usernames, passwords, or even as a directory:

Here we have the wordpress website.

Go to /wp-admin it will redirect us to the login form:

Enter the username, and password we found earlier: admin:FeltHeadwallWight357.

We logged in successfully.

hashtag
Exploitation:

From here we can get command execution since we are admins using two ways as I know: 1. uploading a plugin then use it to get command execution, or by adding a simple one line of php code in one of the themes files, then use it to get a reverse shell as well, I will use the latter, by going to Appearance -> Theme Editor -> Choose one of the PHP files (I chosed error.php, because if we triggered any error the code will be executed):

Scroll down, and click update file:

Now if we went to any non-existent page, we would see an error because of the system function:

Add the cmd paramter, and try any system command:

Nice we have command execution.

Now I will prepare a powershell web-cradle:

Set-up a python3 web server, and a netcat listener:

Then download that file on the system memory and execute it via Invoke-Expression:

We will get a hit to our webserver:

And we have a reverse shell as shenzi:

hashtag
Post-Exploitation:

I will upload winpeas to enumerate the system and try to find any attack vector for privilege escalation:

Run it:

We have two important registries their values has been set to 1 which allow us to elevate our privileges.

You can refer to the hacktricks website for more information:

LogoWindows Local Privilege Escalation - HackTricksbook.hacktricks.wikichevron-right

We can confirm the result of winpeas by quering the registries:

Now I will generate a .msi file, then upload it to the target:

Start another netcat listener:

Use msiexec to execute our installer, so we can get high privilege access:

Going back to our netcat:

We are system.

Get the flags:

PreviousNickelNextMonster

Last updated