So we have scanned the machine and we have port 80 open and port.
3 3 8 9 open.
So we don't have a lot of information here and on port 80 we actually just have a looks like a default
ISIS page of.
I asked ten point zero.
So we're probably up against some sort of newer type of windows it's guessing Windows Server 2016 but
really we don't know right now what I mean to go ahead and do is just kick off a door buster against
this because I have a hunch that we're going to have to do directory busting unless the exploit deals
with 3 3 8 9 which it's possible.
So what we're going to do here is we're going to do say door buster and like that or an ampersand and
then we're just going to utilize the web page so I'm going to go over here I don't remember the IP address
because it is randomized and I'm going to go and just say hey door buster go ahead on H TGP or 80 I
want you to go faster when we scan this so we're going to increase the threading and then we're going
I'm going to go here to user share.
You can start typing door buster and I'm going to scan with word list and the lower case medium that's
60 small might work.
I'm not sure to be honest.
Now we're an IRS page we could scan for something like ISP or ISP x.
I'm just gonna leave this at ISP and roll with that and then we're just going to hit start now while
this is running.
Let's go ahead and talk about some other things.
So we have this scan here right.
We have port 80 open and we can navigate to port 80 when we enumerate this.
We can just go and say copy and then just paste this in and you could see this is just gonna be IRS
page.
Now the other option would be if this was some sort of vulnerability with 3 3 8 9 where we had the blue
key vulnerability.
Now I have never successfully ran blue keep it's always crash for me.
So I don't even consider it an option at this point until there's like a working proof of concept.
Now there might be one out there but the ones that I've seen are not very stable.
So it could be an option but my guess is we're going to investigate 80 and then we're going to log in
probably over 3 3 8 9 or maybe we don't maybe we just get 80 and we get an exploit here.
The times that we see this port 80 in Port 3 3 8 9 4 Windows machines it's common on Linux you'll see
like port 80 and then port 22.
Meaning that typically you'll take 80 as a path in and then you'll find credentials somewhere and use
3 3 8 9 or port 22 and then elevate.
Now if you remember the last box that we had with the service are the unquote quoted service paths.
We did get in and then we were able to escalate or we're able to use 3 3 8 9 if we wanted to because
when we used when piece we found a set of credentials in there for the user Bill.
That's kind of the same little path that we can get a gooey based here on 3 3 8 9 if we wanted to.
So let's check here and see if we can find any information and we see that a does come back of a retro.
And so we could just right click on this and open in browser.
Now if you have any interest in this you're welcome to actually come in here and follow along with their
step by step if you want you can answer the questions like how many ports are open on the target system
and you say two and just gives you sort of that walk through.
So if you want to learn more and do the walkthrough you're more than welcome.
You have to do the walkthrough to get the points anyway so it doesn't hurt to try
OK.
And for me it took retro just a little bit to load.
So if it takes a little bit to load that's absolutely OK and when we're coming through here we kind
of want to look at this page and just see OK well we've got the author of Wade here.
So we want to notate that we have Wade.
We might even open a little no panel is right Wade.
Because Wade could be a potential user name and what I saw when I was looking through here too is that
there's a WP dash content meaning we're looking at a wordpress site.
Now if I'm going to enumerate this further I might run something like WP scan and look for vulnerable
plug ins on this Web site.
I might even try to use the credentials if we find credentials or a user name I might try to brute force
his user name away because we know that Wade's a user so maybe Wade has an easy password and we can
get in or maybe there are vulnerable plug ins and we can utilize that as well.
But when you see a blog page like this on a CTF you should always look around and just see if there's
anything in there that might be advantageous to you.
So you have the different you have the different pages in here and you can actually open these.
So you can open this one and I'm going to open one that does spill out a little information just to
save time on the video.
But we can open this Ready Player One and we should be reading these blog posts too.
Now on some of those they're just like a little write ups.
But here for example you could see first post on the new blog.
I'm excited to share my love of all things.
And this one says I can't believe the movie based my favorite book of all time is going to come out
in a few days.
Maybe it's just because my name is so similar to the main character but honestly I feel a deep connection
to the main character Wade I keep Miss typing the name of his avatar whenever I log in but I think I'll
eventually get it down.
Either way I'm really excited to see this movie.
I keep Miss typing the name of his avatar when I log in but I think I'll eventually get it down.
So he's logging in and he's saying hey I'm using that avatar as my password and I keep screwing it up.
So we go over here and we just look at the ready player one you can see that is actually a comment and
Wade has left a comment for himself.
And so leaving myself a note here just in case I forgot how to spell it.
POWERS Of all the hours I DHL.
So what we can do is we can utilize this and we can try to log in.
So I'm going to use a tool called X free RTP now if you don't have it you should just be able to at
install X free RTP but if we tried to our desktop to this machine it's not going to actually allow us
to do it.
So if we say 10 that turned out twenty six that two hundred.
Now I don't think it will.
So we get the credit SSP error.
So we're going to utilize X free RTP which negotiates for us and I'm going to do a dash dash help.
Just so we can look at the syntax and we can say user name and then we can say we could supply a password
if we want.
We don't have to do that.
And then we just supply the port and the IP address.
So we're gonna do a user do X free RTP slash you.
We're gonna try Wade and then we'll go ahead and just do a slash of V and we'll do the IP address here
and we'll say 10 dot 10 dot 26 that two hundred three three eight nine and let's see if that works and
then we'll go ahead and type in pars of all our easy Ivy Al
so we're gonna accept this certificate here and we are the Ivy a l see if that works looks like it's
trying to log us in here in the box is a little slow mainly because it's on a free server so it looks
like we are actually logging in so at this point we have gotten the low level user.
This is a very common CTF like Box and I actually really like this box because we can sit here and we
just enumerate that's all we do and we have options.
There are some rabbit holes if we want to go down them we can even try to take this and see if we can
log in with these credentials to like the WordPress admin or we could see if there are vulnerable plugins
there might be other path on this machine but we could see here where we're on this gooey interface
we've got the user dot text we've also got this recycle bin if we open the recycle bin maybe there's
some stuff in here there's this HPD to see if we go out to Internet Explorer and we open it up we might
find information here I'm actually going to pause we're going to stop here now that we have a low level
user and then next video will enumerate this and we'll escalate this machine via the CDC twenty nineteen
thirteen eighty eight.
So if you're already ahead of me.
Great job if not I'll see you next video when we actually escalate this machine.