Remote was an easy difficulty windows machine that featured Umbraco RCE and the famous Teamviewer’s CVE-2019–18988. Been thinking to publish an article in OSCP style, it took a while. — Offsec’s PWK Example Report: https://www.offensive-security.com/pwk-online/PWK-Example-Report-v1.pdf I used the above example template for my OSCP exam report and this walkthrough will follow the same template as well.

Servmon is an easy difficulty windows machine retiring this week. We’ll start off by finding anonymous FTP access, gaining SSH creds from NVMS running on port 80 via Directory Traversal. For Privilege escalation, we exploit NSClient++ by SSH tunneling and uploading our malicious script through its API. — RECON As usual, let’s start off with a Nmap scan Nmap scan report for 10.10.10.184 Host is up (0.41s latency)…

OpenAdmin is an easy machine retiring this week. We gain an initial foothold by exploiting OpenNetAdmin RCE and escalate to user jimmy with password reuse. Port forwarding an internal service on the box presents us with an encrypted SSH key, which we crack to gain access as joanna user. Privesc to root is achieved by sudo pwnage of nano command. — RECON As usual, let’s start with a Nmap scan. Nmap scan report for 10.10.10.171 Host is up (0.25s latency).

Traverxec is an easy difficulty machine retiring this week. We gain initial access by exploiting Nostromo Directory traversal / RCE. Enumerating Nostromo config files, we get to know the home directory of Nostromo, which is running as a privileged user. For root, we exploit sudo privilege on journalctl — Enumeration As usual, let’s start off with a Nmap scan. Nmap scan report for 10.10.10.165 Host is up (0.15s latency).

Registry retires this week, it’s one of my favourite boxes for its unique concepts. We gain an initial foothold by enumerating the docker registry API thus finding SSH credentials. For Privesc, we exploit a sudo permission on restic binary. — Let’s get started Enumeration As usual, let’s start off with a Nmap scan. Nmap scan report for 10.10.10.159 Host is up (0.15s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |…

Postman is an easy difficulty machine, which features unauthenticated code execution on Redis, cracking encrypted SSH keys to gain user. For root, we exploit Webmin Package Updates vulnerability where there’s password reuse. In the additional section, I look at another way to get command execution as root with some tweaking of password change functionality. — It’s been a long time since I’ve published an article as I was occupied with my OSCP.

Jarvis was a simple and fun box. I’ll start off by finding an SQLi in one of the webpages and get a basic shell using sqlmap and then bypass a filter on a sudo file to get to the user flag. To get to the root, I’ll abuse a suid binary to obtain root shell. — Enumeration As usual, let’s start off with a Nmap scan.