Proving Grounds Practice — Slort — giselle

Hello, today I’ll talk about the solution of Proving Grounds Practice’s Slort machine.

First, we run an Nmap scan.

I did a directory scan with Gobuster and discovered the /site directory that might work.

Then I checked if I could pull the test.txt file by running a python server.

Yes, we can shoot. We can use this way to get shell.

I created a php shell using msfvenom. Then I uploaded this file with python server.

We receive a shell as user rupert and can now read local.txt.

In the backup directory, info.txt reveals that TFTP.EXE runs every five minutes. We can get an elevated shell by replacing it with our own.

I’m renaming the old file. I’m creating a shell with the same name as msfvenom. And I upload the new file using certutil.

After listening on port 443 with Netcat, the scheduled task fires and we receive an elevated shell.

We now have Administrator access. We can get our proof.txt file.

We find our flag and complete the challenge. Keep hacking !

Practice makes perfect :)