PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
| 2048 36:a3:b5:c4:d1:e9:7f:ba:49:54:4a:e3:1c:6a:56:35 (RSA)
| 256 66:a2:45:35:de:ec:8a:ef:cf:e9:69:cd:d4:75:69:2e (ECDSA)
|_ 256 50:1c:9e:fa:ad:65:3d:f8:a0:57:9b:ca:99:f0:47:90 (ED25519)
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=IamGroot.pwntilldawn.ctf
| Not valid before: 2022-09-16T12:52:10
|_Not valid after: 2023-03-18T12:52:10
| rdp-ntlm-info:
| Target_Name: IAMGROOT
| NetBIOS_Domain_Name: IAMGROOT
| NetBIOS_Computer_Name: IAMGROOT
| DNS_Domain_Name: IamGroot.pwntilldawn.ctf
| DNS_Computer_Name: IamGroot.pwntilldawn.ctf
| Product_Version: 10.0.14393
|_ System_Time: 2022-09-17T14:45:37+00:00
|_ssl-date: 2022-09-17T14:46:16+00:00; +33m56s from scanner time.
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2022-09-17T14:45:39
|_ start_date: 2021-06-24T21:27:58
|_clock-skew: mean: 33m56s, deviation: 0s, median: 33m55s
OpenSSH for_Windows_7.9
searchsploit -m 45233
Create Python2 Virtualenv before running the script
virtualenv -p python2 venv
source venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ gobuster dir -u <http://10.150.150.135/> -w /usr/share/wordlists/dirb/common.txt -q -t 200
/Admin (Status: 301) [Size: 151] [--> <http://10.150.150.135/Admin/>]
/admin (Status: 301) [Size: 151] [--> <http://10.150.150.135/admin/>]
/ADMIN (Status: 301) [Size: 151] [--> <http://10.150.150.135/ADMIN/>]
After waiting for a while we have this prompt but I am not sure how was it triggered
