Lookback

Recon

Ran an Nmap scan, identified the target hostname, and added it to /etc/hosts.

Performed directory enumeration against the web host, yielding the following results.

The /Test directory returns an authentication prompt.

Ran Nikto against the web app for additional context, which surfaced a set of default credentials. These failed against the primary portal, so I attempted them against the Test directory's auth prompt instead.

Initial Foothold

Authentication succeeds, granting the first service-user flag.

The authenticated page exposes a text box that executes commands. After testing input syntax, the working injection pattern is:

');command;#

Using this syntax, I sent a base64-encoded payload and obtained a shell as inetsrv.

Windows System Enumeration

With shell access established, began Windows host enumeration.

Enumerating Users reveals two accounts: Admin and Dev. Under Dev\Desktop, I locate user.txt.

Reviewing TODO.txt for additional context reveals MS Exchange is installed with a pending security update [TO BE DONE] - a likely vulnerability. Searched Exploit-DB via searchsploit for related MS Exchange CVEs and also recovered several user email addresses from the file.

Exploitation

The searchsploit query returns numerous candidate exploits, so I pivot to Metasploit to select a module.

Modules 16 and 8 appear to best match the target's version/configuration; module 16 is tried first.

Exploitation succeeds, dropping into a shell. Enumerated current privileges before continuing.

The resulting privilege level provides significantly more access than the initial foothold shell.

Flag & Privilege Escalation

Located the next flag via a system-wide file search and read its contents using the elevated privileges obtained above - challenge complete.