HackTheBox_Devel | w/ Metasploit

HTB - Devel

Overview

This example is a walkthrough for a Hack The Box machine, showcasing enumeration, vulnerability exploitation, and privilege escalation.

Enumeration

Nmap Scan Results

To begin, I performed an Nmap scan to discover open ports and services running on the target machine.

Homepage

After the Nmap scan, I checked the homepage of the target server.

Exploitation w/ Metasploit + Msfvenom

FTP Access

I accessed the FTP server anonymously.

Directory Listing

Next, I checked the directory structure on the FTP server.

Reverse Shell Upload

I created a reverse TCP shell script using Msfvenom and uploaded it to the FTP server as a .aspx file, given that the server runs Microsoft IIS version 7.5.

Meterpreter Session

Using Metasploit, I opened a Meterpreter session to gain access to the target machine.

Enumeration After Access

With access gained, I proceeded with further enumeration to gather information about the system.

Local Exploit Suggester

I utilized Metasploit’s local exploit suggester to identify potential privilege escalation vulnerabilities.

Exploitation

Using the suggested exploit, I managed to escalate privileges and gain full control over the target machine.

Finally, I located and captured the flags.

User Flag

Root Flag

Pwned