Antique
Last updated
Last updated
Enumeration machine.
We found JetDirect on port 23 so we can check more info by using netcat.
The "-v" flag specifies that we would like verbose output (more detailed). The "-n" option specifies that we do not wish to use DNS or service lookups on any addresses, hostnames or ports.
Searching vulnerability for HP JetDirect (printer).
Execution:
Copying result to the CyberChef.
Log in to telnet by using found credentials.
We can execute system commands.
Testing:
Reverse shell to our machine.
Starting listener and executing above command.
We are inside, so we can get a first flag:
Uploading linpeas and interesting results:
Uploading nmap to victim machine.
source:
Results:
Checking architecture.
Source to download Chisel.
We have to install Chisel on our machine and victim system.
Starting Chisel server on our machine.
Starting Chisel on victim system.
Checking the previously found port.
We can find exploit for CUPS 1.6.1.
Downloading exploit to our kali and uploading to victim system.
Running exploit:
I was trying to crack hash from /etc/shadow but no success.. so I read the root flag:
Port Forwarding – Chisel:
Session is open
or:
