Challenge 4 - Machine Credentials

MS01(192.168.219.141)

Credentials

Nmap

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-28 03:18 EDT Warning: 192.168.219.141 giving up on port because retransmission cap hit (10). Nmap scan report for 192.168.219.141 Host is up (1.2s latency). All 65535 scanned ports on 192.168.219.141 are in ignored states. Not shown: 55110 open|filtered udp ports (no-response), 10425 closed udp ports (port-unreach)

Nmap done: 1 IP address (1 host up) scanned in 155.99 seconds

Nmap 7.94SVN scan initiated Fri Mar 28 03:19:13 2025 as: /usr/lib/nmap/nmap -sS -p- --min-rate 5000 -oO 192.168.219.141 nmap-sS.result

Nmap scan report for 192.168.219.141 Host is up (0.10s latency). Not shown: 65516 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 81/tcp open hosts2-ns 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3306/tcp open mysql 3307/tcp open opsession-prxy 5040/tcp open unknown 5985/tcp open wsman 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49669/tcp open unknown 49670/tcp open unknown 51775/tcp open unknown

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-28 03:58 EDT Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 52.63% done; ETC: 03:59 (0:00:23 remaining) Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 52.63% done; ETC: 03:59 (0:00:23 remaining) Nmap scan report for 192.168.219.141 Host is up (0.10s latency).

PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_8.1 (protocol 2.0) | ssh-hostkey: | 3072 e0:3a:63:4a:07:83:4d:0b:6f:4e:8a:4d:79:3d:6e:4c (RSA) | 256 3f:16:ca:33:25:fd:a2:e6:bb:f6:b0:04:32:21:21:0b (ECDSA) |_ 256 fe:b0:7a:14:bf:77:84:9a:b3:26:59:8d:ff:7e:92:84 (ED25519) 80/tcp open http Apache httpd 2.4.51 ((Win64) PHP/7.4.26) |_http-server-header: Apache/2.4.51 (Win64) PHP/7.4.26 81/tcp open http Apache httpd 2.4.51 ((Win64) PHP/7.4.26) |_http-server-header: Apache/2.4.51 (Win64) PHP/7.4.26 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3306/tcp open mysql MySQL (unauthorized) 3307/tcp open opsession-prxy? 5040/tcp open unknown 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 51775/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: |smb2-time: Protocol negotiation failed (SMB2) | smb2-security-mode: | 3:1:1: | Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 137.99 seconds

80

81

http://192.168.205.141:81/db/

Screen shot

Admin credentials nurhodelta : $2y$10$fCOiMky4n5hCJx3cpsG20Od4wHtlkCLKmO6VLobJNRIg9ooHTkgjK:password

employees

http://192.168.205.141:81/Admin/index.php

刚刚的账户密码用不了

http://192.168.205.141:81/conn

SQL information

Exploit

139

PE

SeImpersonatePrivilege提权利用

Domain/Proxy Setting

Credentials

net user /domain

File investigation

RDP Open

Proxy

MS02(10.10.165.142)

Nmap

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-28 06:49 EDT Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 2.15 seconds

IP CHANGED

Domain Done