Algernon

Source: Proving Grounds OS: Windows Community Rating: Easy

Enumeration & Reconnaissance

• I started by running autorecon, and it exposed many ports on the target: 135, 139, 21, 17001, 445, 49664, 49665, 49666, 49667, 49668, 49669, 5040, 80, 9998.

• That’s a lot to deal with, luckily autorecon exposed port 80 and 9998 first, so I started with those two. Port 80 was just the default IIS page, while port 9998 was running an application called SmarterMail.

SmarterMail

Gaining Initial Access

• I searched for a CVE right away and found CVE-2019-7214. A PoC existed on Exploit-DB—I simply changed the IP addresses, and it worked perfectly.

CVE-2019-7214

Privilege Escalation

• When I got the shell back, I was already NT AUTHORITY\SYSTEM, so there was no need for further privilege escalation. Such an easy box!

Reverse Shell

Lessons Learned

• This is a hard one, Check for CVEs?, I guess.