Scribd
Upload
1 views6 pages

Remote

The document outlines a security assessment involving the identification of open ports and services, specifically NFS and SMB, which allow for enumeration of shared resources and potential credential extraction. It details the process of exploiting a vulnerability in the 'umbraco' service after gaining access to the NFS port, leading to a reverse shell. Finally, it describes privilege escalation using the 'SeImpersonatePrivilege' to achieve SYSTEM access through a Potato attack.

Uploaded by

chittimilla.saitarun7c
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
1 views6 pages

Remote

The document outlines a security assessment involving the identification of open ports and services, specifically NFS and SMB, which allow for enumeration of shared resources and potential credential extraction. It details the process of exploiting a vulnerability in the 'umbraco' service after gaining access to the NFS port, leading to a reverse shell. Finally, it describes privilege escalation using the 'SeImpersonatePrivilege' to achieve SYSTEM access through a Potato attack.

Uploaded by

chittimilla.saitarun7c
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Remote

Nmap

-> Port 2049 is open, which indicates that the NFS (Network File System) service is running.
To access shared directories, we need to mount the NFS share locally.

->Additionally, since the SMB port is open, we can perform SMB enumeration to gather
further information such as shared resources, users, or potential credential.

Whatweb/Nikto
Gobuster

-> This "umbraco" redirects us to a login page.


-> I found an exploit on umbraco. But in order to exploit it I need to be logged in.

Nfs

-> I got access to nfs port.

-> Maybe I can get username and password. So, lets enumrate to find the credentials.
-> we got uesrname and password hash. Now, we can decode it to get the password.

Initial Access

-> Now that I’ve identified the service version, which matches a known vulnerability listed on
Exploit-DB, we can proceed with exploiting it

-> Now, I can inject the payload to get the reverse shell.
-> I got this payload from reverse shell generator.

-> Finally, we got the shell.

Privilege Escalation

-> I identified that the user has the 'SeImpersonatePrivilege' enabled, which allows me to
perform a Potato attack (e.g., Juicy Potato, Rogue Potato) to escalate privileges to
SYSTEM.

You might also like