# OSCP A -> independent

## Recon
### Rustscan
* 192.168.170.143(Aero)
* 

* 192.168.170.144(Crystal)
* 

* 192.168.170.145(Hermes)
* 

### Nmap
* 192.168.170.143(Aero)
* 

* 192.168.170.144(Crystal)
* 

* 192.168.170.145(Hermes)
* 

## 143 --> local.txt
* When I google cgms 3003 port,I found a aerospike database RCE,and use nc check version 5.1.0.1,match the exploit
* 
* 
* Download the PoC,and execute it
* https://github.com/b4ny4n/CVE-2020-13151
* Got shell from aero
* 
## 143 --> proof.txt
* Upload the `pspy` and saw `/usr/bin/asinfo` execute so many time
* 
* Check the prvilege,we can modify it to reverse shell
* 
* 

* Got shell from root
* 

## 144 --> local.txt
* http://192.168.170.144:80,has git page leak
* 
* Using `dirsearch` scan path
* 
* Using `git_dumper` download whole `.git` folder
* https://github.com/arthaud/git-dumper
* 
* Found DB user credential in `datavase.php`
* 
* `[e-mail]:BreakingBad92`

git diff-tree -p HEAD

* This credential allow us login to FTP and ssh, and we got local.txt
* `stuart:BreakingBad92`
* 
* 
## 144 --> proof.txt
* Found `backup` folder in `/opt`, using `scp` download the backup files,and only `sitebackup3` is the zip file,also need password
* 
* 
* Use `zip2john` and crack the pasword
* 
* 

* Found credential for user `chloe`
* 
* 

* And `chole` can swtich to root

* 

## 145 –> local.txt
* Fllow the nmap scan result,I'm searching the tcp 1978 port on google, and got a service name&vertion
* This service called `WiFi Mouse 1.7.8.5`, and it has RCE vulnerability
* 
* 
* So, first I create a backdoor executable file with `msfvenom`, then run the script and got shell with `nc`
* 
* 
* 

## 145 –> proof.txt
* Found PUTTY has installed at `C:\Program Files` on this machine
* 
* PUTTY stores user credentials in plain text in windows registry, and we got the user `zachary`'s password
* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.002/T1552.002.md
* 
* 
* `zachary:h3R@tC@tch3r`

reg query HKCU\Software\SimonTatham\PuTTY\Sessions /t REG_SZ /s

* Connect with RDP as `zachary`, but still can't found proof.txt,until I run the powershell as administrator
*