# 192.168.135.96 (ERA)

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FYwJEJMiuStXFdrH2ojsB%2Fimage.png?alt=media&#x26;token=3db66d83-c39f-4e34-8a2e-4dc23a876f2e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F0mIRe3rsyc1tSytIPqKy%2Fimage.png?alt=media&#x26;token=0ef2cb26-3968-43ea-91f5-045d9873c56a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F1zJs92GVkK9l8xY7Sw4Y%2Fimage.png?alt=media&#x26;token=d6550b03-7bd5-4c49-b1b8-190296d613e2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FzMnrp378mFcash59nCAW%2Fimage.png?alt=media&#x26;token=b4f7556d-9a0f-48ff-947b-2c0ae4484900" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F54TLHIqaoA7Fj6EcFxIq%2Fimage.png?alt=media&#x26;token=4a33c125-78a1-412e-b6bf-c57da89f6b25" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FilEkvZTLIuJFyUGJTc0P%2Fimage.png?alt=media&#x26;token=01a60ca6-7989-438f-9ad4-a28602217683" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FcOklYeexgaF3QFzhtyh5%2Fimage.png?alt=media&#x26;token=e1526fd2-6e99-4919-9b20-54e8fb668ad6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FP5TgF9BWNXRmn30k3l4h%2Fimage.png?alt=media&#x26;token=d71ba633-9055-4bd3-9d1c-2282113902b7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FGvsJXibeLJpm4XLmgumX%2Fimage.png?alt=media&#x26;token=cfd4776f-3501-4ada-a6a3-fdb50320d3ad" alt=""><figcaption></figcaption></figure>

* Gobuster comes up nothing

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2Fq20cSFWc6rl6MW8ljqYP%2Fimage.png?alt=media&#x26;token=31611177-78bc-4baf-ac80-cd7ee0b152ce" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FXBTu61ScQnGExWw8IHhk%2Fimage.png?alt=media&#x26;token=5e8e82a9-233f-4b23-b573-f06d262ec932" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FMNTwOAC8PGklivdTyX6u%2Fimage.png?alt=media&#x26;token=b3eb1732-cd35-4c0c-bee1-0d481dde1406" alt=""><figcaption></figcaption></figure>

* Access Method:

```
evil-winrm -i 192.168.135.96 -u Apache -p New2Era4\.\!
```

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FEAZbNiQu1STyqQNs6cTr%2Fimage.png?alt=media&#x26;token=0641e901-645c-42d2-881d-0d64e44f31cc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2Fgcnpdg2h1y4kQaIWYjaT%2Fimage.png?alt=media&#x26;token=622d1d6c-522f-4dab-8066-b98eeefbe9ca" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F9snJRosf0q11FROpzYfz%2Fimage.png?alt=media&#x26;token=6f55d19c-7880-462b-bfca-b102249d5c6e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F7lkUfOEwbzS1rGVKDxZt%2Fimage.png?alt=media&#x26;token=a36146e0-0fe8-43b7-8f72-5d0506e86d13" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FLIeSddq7CjLByEpRnlKv%2Fimage.png?alt=media&#x26;token=5155605c-d27d-4ae6-abb9-be8f3c5938e9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F87Dsaaums4h2Lw6YbFrv%2Fimage.png?alt=media&#x26;token=4e33a1b6-f1fd-43c5-bb9b-aad45138b1b4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FhIqpE4jAORuP72uEdcRr%2Fimage.png?alt=media&#x26;token=7d3cbaf4-66c7-49e5-98ee-6f1b452e2577" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FeBESAFkrCyJq4wA2LMEN%2Fimage.png?alt=media&#x26;token=160147a1-9133-456f-be4a-487d875bf97a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FvSIiyFyoui0dBT9OW8F1%2Fimage.png?alt=media&#x26;token=f9118b90-4c13-4caf-9a1d-a95b9616c2ce" alt=""><figcaption></figcaption></figure>

```
icacls C:\xampp\apache\bin\httpd.exe
icacls C:\xampp\mysql\bin\mysqld.exe
```

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FXfaaNIwlLu1xA98xHIgr%2Fimage.png?alt=media&#x26;token=d283d2b2-c9ed-4fbf-ad6e-379402b7db7d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FQvri3UHDvqllyXP9jNQU%2Fimage.png?alt=media&#x26;token=a98d34c5-861a-42a3-b707-911dc3b03f7d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FO890nEB4yy2gFQHLDcOc%2Fimage.png?alt=media&#x26;token=be4885b5-6d22-4dbf-a214-ef06c5a0ed55" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FbfpSfCew6oA0vpfu8Fcf%2Fimage.png?alt=media&#x26;token=5df25484-7c22-4cab-b1de-efbbeb297d6e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2Fm9fUl4VTyIAP5GrImFaz%2Fimage.png?alt=media&#x26;token=fed7576f-8550-4eda-9d88-0ac696e757a0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F1HfMxTuuDnMP3BnwX4be%2Fimage.png?alt=media&#x26;token=8d9e81bd-45a7-4574-893a-e8468c6263a0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FtRyxrnK6GUpzYdAEQpov%2Fimage.png?alt=media&#x26;token=ac90d99a-f4bc-43c3-ae10-1ebca9bed2da" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FduoSoeg2kmSvvAwDln7J%2Fimage.png?alt=media&#x26;token=ad0e46ea-3065-4470-b9d9-55512d17c697" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FEpOYHrntCkGTaITem4jC%2Fimage.png?alt=media&#x26;token=df66c7bf-03ea-4eae-9e57-1a02b721d86c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2Fg2zQRrfpaRMrPKXlrxto%2Fimage.png?alt=media&#x26;token=54a13b0f-d7a6-4d85-af07-3d9763048735" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F7AAEDRHPbSPVTyqzWkQt%2Fimage.png?alt=media&#x26;token=e7099604-a5db-49e8-8238-6f36e110c70c" alt=""><figcaption></figcaption></figure>

* Apparently you're supposed to do some port forwarding and log in to the sql database, since the database is configured to only allow local logins
* None of my reverse port forwarding works as .96 cannot reach my Kali
* Somehow found this comment in the discord

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2Fjp5hMwcpr3SookALIbDA%2Fimage.png?alt=media&#x26;token=094307cd-df0d-4f06-8ffd-3fba45969a88" alt=""><figcaption></figcaption></figure>

* Update: Me and hour later: After turning my Kali off and on, the problem is miraculously fixed.
  * But am too lazy to figure out the proper way TT
* fuck it bro

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FbNFdudZEyJkRn4wspJ8W%2Fimage.png?alt=media&#x26;token=25ad6a21-2f57-4e69-8676-1bcc13814bca" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FsnsfR4dJSUT5yRkVqOzf%2Fimage.png?alt=media&#x26;token=2158dc72-c9c0-4a91-9886-ac08d371f327" alt=""><figcaption></figcaption></figure>

* Holy Fuck...

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FqoX8DBsgBSzkUzTzl14l%2Fimage.png?alt=media&#x26;token=851b0f70-427a-4732-bfbe-f27558c47f17" alt=""><figcaption></figcaption></figure>

| Username      | Password        |
| ------------- | --------------- |
| Administrator | Almost4There8.? |
| Charlotte     | Game2On4.!      |

* Was able to verify the credentials with this writeup

{% embed url="<https://github.com/BJ1995/OSCP_PREP/blob/main/Challenge%20Lab%200_SECURA.txt>" %}

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F2S36byXvvfi49jbKj8Wc%2Fimage.png?alt=media&#x26;token=cda656c5-7d6b-4486-b69e-6b4a166c7449" alt=""><figcaption></figcaption></figure>

```
Location: C:\Users\apache\Desktop\local.txt
Flag: 7bbd59603572906999de5f5b9885a041

Location: C:\Users\Administrator\Desktop\proof.txt
Flag:4945750a1aeb6d6004f8a626cbcb5072
```

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2FHOq3UZoF9bqztWkYasH1%2Fimage.png?alt=media&#x26;token=a34af015-38d4-4e00-af82-1b373b160f49" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1442460206-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8ceqkAwoADxbBo9YV3o7%2Fuploads%2F4O8ooVWqpJZCfcm4Ffn5%2Fimage.png?alt=media&#x26;token=bb6bd8d2-9b46-438d-b8e3-3633585e3554" alt=""><figcaption></figcaption></figure>
