Optimum Walkthrough

Hello Everyone! Today we have an interesting machine from HackTheBox “Optimum”, in this machine we, will learn about a new tool for CVE scan, it’s useful, at the first let’s know more about our machine

Ok, let’s get started…

Nmap Scan

As we begin every machine we will scan the DNS for open ports, service running on them, OS detection, and more information we need to know

The results say that there’s one open port 80 and one service running on it HttpFileServer 2.3 so we will take this as an entry point to search for any vulnerability in this service by google or searchsploit

So now we have exploitation from rapid7 which works with metasploit and also you can use this code from GitHub to hack it without metasploit but you need to edit it

we will use metasploit to hack this service so we will use metasploit search about this keyword as follow

nice, we have one here, let’s try it by typing use 0 and then show options and set the machine IP from RHOSTS and your local IP from LHOST and finally, type run to start attack

As you can see it’s worked and opened a new meterpreter session but it seems that we’re not the root so let’s get the user flag first..

Good, now we have the user flag, let’s try to get the root flag from Administrator directory

Unfortunately, we don’t have access to this directory, so let’s think about how to exploit the privileges escalation vulnerability to do that we need to do 2 things:

  1. Get the system info from systeminfo

  2. Try to search about the CVE available for this info

As you can see now we have the system information, let’s jump to the next step.

I have searched more and more about privilege escalation vulnerability for this info, but unfortunately, there’s nothing returned, so I’ve discovered a wonderful tool that will scan the machine for the CVE’s and return back me the results, a tool named Windows-Exploit-Suggester which needs the systeminfo data in .txt format as follows

and then run the tool

With all available exploitation with this machine, we will use one which will help us in the escalation process ms16-032 you will find it on the metasploit

but before using it you should put the meterpreter session in the background by typing background

now you can search about the exploitation and use it, then type show options and set SESSIONS 1 as you have the session 1

and then run. You will get a new shell with the root privileges

Congrats ❤

PreviousJerry WalkthroughNextGrandpa Walkthrough

Last updated