# Optimum Walkthrough

Hello Everyone! Today we have an interesting machine from HackTheBox “Optimum”, in this machine we, will learn about a new tool for CVE scan, it’s useful, at the first let’s know more about our machine

<figure><img src="https://cdn-images-1.medium.com/max/800/1*2JISyuW5P8K04KyzoxhLng.png" alt=""><figcaption></figcaption></figure>

Ok, let’s get started…



## **Nmap Scan**

As we begin every machine we will scan the DNS for open ports, service running on them, OS detection, and more information we need to know

```
> nmap -A -T4 -oG blue.gnmap 10.10.10.8
```

```
-A : service detection, OS detection, script results 
-T4: Threads=4 to increase the speed 
-oG: to get the output in the extension gnmap to brute force the credentials.
```

The results say that there’s one open port 80 and one service running on it `HttpFileServer 2.3` so we will take this as an entry point to search for any vulnerability in this service by `google` or `searchsploit`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*VMcxeBcx-Qb_0m5yUYxF_A.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://cdn-images-1.medium.com/max/800/1*CI1C_e4TG_6Vuajswdzd7w.png" alt=""><figcaption></figcaption></figure>

So now we have exploitation from [rapid7](http://www.rapid7.com/) which works with `metasploit` and also you can use this [code](https://github.com/am0nsec/exploit/blob/master/windows/http/RejettoHTTPFileServer-2.3/rejetto_hfs.py) from GitHub to hack it without `metasploit` but you need to edit it

<figure><img src="https://cdn-images-1.medium.com/max/800/1*tqsoHBj5a3xCK6M77AD8QA.png" alt=""><figcaption></figcaption></figure>

we will use metasploit to hack this service so we will use metasploit search about this keyword as follow

<figure><img src="https://cdn-images-1.medium.com/max/800/1*ixDgceMrXk67Nr-nbVG9Ug.png" alt=""><figcaption></figcaption></figure>

nice, we have one here, let’s try it by typing `use 0` and then `show options` and set the machine IP from `RHOSTS` and your local IP from `LHOST` and finally, type `run` to start attack

<figure><img src="https://cdn-images-1.medium.com/max/800/1*_uCEiCpMpG14AmjMQTU-BQ.png" alt=""><figcaption></figcaption></figure>

As you can see it’s worked and opened a new `meterpreter` session but it seems that we’re not the root so let’s get the user flag first..

<figure><img src="https://cdn-images-1.medium.com/max/800/1*sXNQVAmMHXYP8WwXiCOZjQ.png" alt=""><figcaption></figcaption></figure>

Good, now we have the user flag, let’s try to get the root flag from `Administrator` directory

<figure><img src="https://cdn-images-1.medium.com/max/800/1*ND33CFvXEBuXjslyCHW11g.png" alt=""><figcaption></figcaption></figure>

Unfortunately, we don’t have access to this directory, so let’s think about how to exploit the privileges escalation vulnerability to do that we need to do 2 things:

1. Get the system info from `systeminfo`
2. Try to search about the CVE available for this info

<figure><img src="https://cdn-images-1.medium.com/max/800/1*z2XxIY4o18Tqjscdzg6cTg.png" alt=""><figcaption></figcaption></figure>

As you can see now we have the system information, let’s jump to the next step.

I have searched more and more about privilege escalation vulnerability for this info, but unfortunately, there’s nothing returned, so I’ve discovered a wonderful tool that will scan the machine for the CVE’s and return back me the results, a tool named [Windows-Exploit-Suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester) which needs the `systeminfo` data in `.txt` format as follows

```
Host Name:                 OPTIMUM
OS Name:                   Microsoft Windows Server 2012 R2 Standard
OS Version:                6.3.9600 N/A Build 9600
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Server
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User
Registered Organization:   
Product ID:                00252-70000-00000-AA535
Original Install Date:     18/3/2017, 1:51:36 ��
System Boot Time:          16/12/2020, 12:19:02 ��
System Manufacturer:       VMware, Inc.
System Model:              VMware Virtual Platform
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
BIOS Version:              Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume1
System Locale:             el;Greek
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC+02:00) Athens, Bucharest
Total Physical Memory:     4.095 MB
Available Physical Memory: 3.528 MB
Virtual Memory: Max Size:  5.503 MB
Virtual Memory: Available: 4.979 MB
Virtual Memory: In Use:    524 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    HTB
Logon Server:              \\OPTIMUM
Hotfix(s):                 31 Hotfix(s) Installed.
                           [01]: KB2959936
                           [02]: KB2896496
                           [03]: KB2919355
                           [04]: KB2920189
                           [05]: KB2928120
                           [06]: KB2931358
                           [07]: KB2931366
                           [08]: KB2933826
                           [09]: KB2938772
                           [10]: KB2949621
                           [11]: KB2954879
                           [12]: KB2958262
                           [13]: KB2958263
                           [14]: KB2961072
                           [15]: KB2965500
                           [16]: KB2966407
                           [17]: KB2967917
                           [18]: KB2971203
                           [19]: KB2971850
                           [20]: KB2973351
                           [21]: KB2973448
                           [22]: KB2975061
                           [23]: KB2976627
                           [24]: KB2977629
                           [25]: KB2981580
                           [26]: KB2987107
                           [27]: KB2989647
                           [28]: KB2998527
                           [29]: KB3000850
                           [30]: KB3003057
                           [31]: KB3014442
Network Card(s):           1 NIC(s) Installed.
                           [01]: Intel(R) 82574L Gigabit Network Connection
                                 Connection Name: Ethernet0
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 10.10.10.8
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.
```

and then run the tool

```
$ ./windows-exploit-suggester.py --database 2020-06-06-mssb.xlsx --systeminfo systeminfo.txt
```

With all available exploitation with this machine, we will use one which will help us in the escalation process `ms16-032` you will find it on the metasploit

<figure><img src="https://cdn-images-1.medium.com/max/800/1*7ruSidpSJ_ZqVMEbnI9NIA.png" alt=""><figcaption></figcaption></figure>

but before using it you should put the meterpreter session in the background by typing `background`

<figure><img src="https://cdn-images-1.medium.com/max/800/1*14UqbRc2Edz7yOAUcsbxyQ.png" alt=""><figcaption></figcaption></figure>

now you can search about the exploitation and use it, then type `show options` and `set SESSIONS 1` as you have the session 1

<figure><img src="https://cdn-images-1.medium.com/max/800/1*u-4GvuzQ6VeSIVN5ZNSIyA.png" alt=""><figcaption></figcaption></figure>

and then `run.` You will get a new shell with the root privileges

<figure><img src="https://cdn-images-1.medium.com/max/800/1*NasUfesqStdCFbazLbpQMg.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://cdn-images-1.medium.com/max/800/1*6Wmo2G2fl7pERnrL5aE3Cg.png" alt=""><figcaption></figcaption></figure>

**Congrats ❤**
