All right.
Our scan is back and you can see we have quite a few ports open.
So we've got port 80 open and it looks like a default IRS type page one thirty nine for forty five and
also one thirty five for the RBC so we've got S&P open we've got 3 3 8 9 open we've got this fifty nine
eighty five which says HDP but I know that to be win our M and we've also got port 880 which says HP
file server.
Two point three HMS vial server.
So the H of X is a really really well known vulnerable application that I have seen time and time again
on a lot of these Capture the Flag type site.
So this one just gets my wheel spinning.
However if you're newer you don't know that this exists then you can just say hey I see that there's
a file server I see something here on Port ADT might be worth enumerating where I'm port 80.
There's nothing here we might have to render buster or something along those lines.
One thirty nine for forty five.
We'd probably look for a service version.
We'll see if there's any type of samba vulnerability there or if we can enumerate the the session or
the shares that are in here.
But for now when I see something like this this is kind of where my mind goes so I'm going to go ahead
and just navigate out to this machine over on Port 88.
And we'll see how this works.
So let's go ahead and just do this and then we'll do port 80 80.
All right.
And we are given this page here.
Now if we see that there is the HMS.
Two point three we could quickly just do a search on this like a search point we can go into a new window.
And I would just do something like search boy and just paste that see if that comes back and then I'll
start deleting from it.
That's nothing.
We might try HMS 2 or something along those lines and see if we can find it.
And it does show up as this rigid O H TGP file server and then we see a Ruby here.
So Ruby always tells me hey we've probably got a Metis VoIP module.
So what I'll do is I'll just boot up Meadows VoIP and I do have met a split still open and running from
our past.
So I'm going to go ahead just close that or get rid of this one here.
And so let's go ahead and just search for HMS Earl see if it shows up which it does.
So we have this exploit windows HP Riggio and we'll just say use one and we'll do info.
We'll make sure that we're actually attacking something that we need to be.
OK.
So this is vulnerable to remote command execution due to poor Reg X in the file parser lived up past.
So it says this has been tested successfully on each of us two point three B Bravo over Windows XP Service
Pack three windows 7 and Windows 8.
Let's see if we have any information on our windows machine.
It looks like it is a Windows Server 2008 which shouldn't scare us away here.
We are seeing the two point three.
We're not seeing necessarily that this is a B.
So this may or may not work for us but I think we should give it a go.
So what we'll do is we'll say options and we could see poor 80 80 is a server port.
Our port of 80 and what we're gonna do is we're going to just set this up where we say set our port
of 80 80.
Because we're not over port 80 and we're also going to provide here the IP address which is the our
host.
So we'll say that our hosts to 10 that turned out one forty eight that one thirty nine.
Make sure that you set your whole host to tunnel 0 and let's go ahead and run this see if it works sometimes
it doesn't work on the first go.
We'll see if we get lucky here.
And we've got a return pretty session.
So hit Enter way for this to run through may or may not delete it did.
OK so we'll get our new I.D. here and you can see we are good old Bill.
So now we're Bill.
We're going to have to do some privilege escalation and see what we can do.
So let's go ahead and pause here in the next video what we're gonna do is we're going to take this and
we're going to escalate or attempt to escalate.
And just a little hint unquote quoted service pass if you want to give this a go and see if you can
find the encoded service path and escalate it that way.
Feel free.
But from here we're gonna do the unquote service back in the next video.