OffSec · Lab
Access
IP: 192.168.218.187
set ip 192.168.218.187
set url 'http://192.168.218.187'
curl http://192.168.45.231:8000/
creds
svc_mssql : trustno1
Nmap basic
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
443/tcp open https
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49668/tcp open unknown
49669/tcp open unknown
49670/tcp open unknown
49671/tcp open unknown
49674/tcp open unknown
49679/tcp open unknown
49701/tcp open unknown
49817/tcp open unknown
Nmap service
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.48 ((Win64) OpenSSL/1.1.1k PHP/8.0.7)
|_http-server-header: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
|_http-title: Access The Event
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-09-07 06:45:30Z)
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: access.offsec, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: SERVER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-09-07T06:45:33
|_ start_date: N/A
cmd.php
trying to pass the filters
trying custom .htaccess
Fuzzd files
Target: http://192.168.218.187/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000069: 200 1100 L 3299 W 49680 Ch "index.html"
000000379: 200 1100 L 3299 W 49680 Ch "."
000002453: 200 1100 L 3299 W 49680 Ch "Index.html"
000007002: 200 0 L 0 W 0 Ch "ticket.php"
Fuzzd dirs
Target: http://192.168.218.187/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000084: 200 19 L 100 W 1605 Ch "assets"
000000070: 200 15 L 52 W 777 Ch "uploads"
000000170: 200 16 L 62 W 985 Ch "forms"
000000386: 200 1004 L 4963 W 73983 Ch "icons"
000000519: 503 11 L 44 W 404 Ch "examples"
000000765: 200 19 L 100 W 1605 Ch "Assets"
000000754: 200 15 L 52 W 777 Ch "Uploads"
000000988: 200 16 L 62 W 985 Ch "Forms"
000007915: 200 16 L 62 W 985 Ch "FORMS"
000011308: 200 15 L 52 W 777 Ch "UPLOADS"
000030589: 200 19 L 100 W 1605 Ch "ASSETS"
000034042: 200 15 L 52 W 777 Ch "UpLoads"
Fuzzd /uploads for files
Target: http://192.168.218.187/uploads/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000157: 403 9 L 30 W 304 Ch ".htaccess"
BLING
