{"id":243,"date":"2025-09-13T19:07:00","date_gmt":"2025-09-13T19:07:00","guid":{"rendered":"https:\/\/thecyberstaff.com\/?p=243"},"modified":"2025-12-28T18:47:31","modified_gmt":"2025-12-28T18:47:31","slug":"servmon-hackthebox-lab","status":"publish","type":"post","link":"https:\/\/thecyberstaff.com\/?p=243","title":{"rendered":"ServMon- Hackthebox lab"},"content":{"rendered":"\n<p>This box took a ton of troubleshooting and resets for the privilege escalation. The web server kept crashing but after many attempts, I finally got it finished. I start things off with a port scan for all 65,535 TCP ports and the top UDP ports. I ended digging into port 21 for a FTP anonymous login and found a file that had some important content, then used an export for the CCTV server on port 80. That got me SSH access while led to a vulnerable software that was used to obtain system access.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"480\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image.png\" alt=\"\" class=\"wp-image-330\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image.png 640w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-300x225.png 300w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"480\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-2.png\" alt=\"\" class=\"wp-image-332\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-2.png 640w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-2-300x225.png 300w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>With the FTP anonymous session, I found a file called Confidential.txt that had a nice clue, a password file that is located on Nathans desktop.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"148\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-3-1024x148.png\" alt=\"\" class=\"wp-image-333\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-3-1024x148.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-3-300x43.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-3-768x111.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-3.png 1148w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I found this NVMS-1000 web server and started looking into public exploits available.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"764\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-4-1024x764.png\" alt=\"\" class=\"wp-image-334\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-4-1024x764.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-4-300x224.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-4-768x573.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-4.png 1115w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I got some hits with searchsploit.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"125\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5-1024x125.png\" alt=\"\" class=\"wp-image-335\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5-1024x125.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5-300x37.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5-768x94.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5-1536x187.png 1536w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-5.png 1584w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>This exploit uses a directory traversal that can be used to read files on the Windows machone.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"478\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-6.png\" alt=\"\" class=\"wp-image-336\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-6.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-6-300x140.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-6-768x359.png 768w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>First I tested the exploit with the default payload.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"330\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-7-1024x330.png\" alt=\"\" class=\"wp-image-338\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-7-1024x330.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-7-300x97.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-7-768x248.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-7.png 1224w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Then, I used it to read that Passwords.txt file that we learned about earlier revealing a list of passwords.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"343\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-8-1024x343.png\" alt=\"\" class=\"wp-image-339\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-8-1024x343.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-8-300x100.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-8-768x257.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-8.png 1224w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I was unsure about what password went to what user so I used Hydra to check all users and passwords that I have found so far with ssh.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"951\" height=\"215\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-9.png\" alt=\"\" class=\"wp-image-340\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-9.png 951w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-9-300x68.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-9-768x174.png 768w\" sizes=\"auto, (max-width: 951px) 100vw, 951px\" \/><\/figure>\n\n\n\n<p>I got into the box with ssh and found a program called NSClient++.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"480\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-10.png\" alt=\"\" class=\"wp-image-341\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-10.png 640w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-10-300x225.png 300w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>I got a hit on Searchsploit for a local privilege escalation. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"112\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11-1024x112.png\" alt=\"\" class=\"wp-image-342\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11-1024x112.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11-300x33.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11-768x84.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11-1536x169.png 1536w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-11.png 1566w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I grabbed the webserver password from the nsclient.ini file after doing some research on the product.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"640\" height=\"480\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-12.png\" alt=\"\" class=\"wp-image-343\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-12.png 640w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-12-300x225.png 300w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p>This exploit will run a local file as SYSTEM. I put a file on the system called protection.bat that will use netcat to reach out to my Kali box with a reverse shell.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-13-1024x576.png\" alt=\"\" class=\"wp-image-344\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-13-1024x576.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-13-300x169.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-13-768x432.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-13.png 1280w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>I added this script information to the webserver and used the run function to run it after committing changes. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-14-1024x576.png\" alt=\"\" class=\"wp-image-345\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-14-1024x576.png 1024w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-14-300x169.png 300w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-14-768x432.png 768w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-14.png 1280w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The script ran as system and gave me system level access to the box!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"490\" height=\"207\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-15.png\" alt=\"\" class=\"wp-image-346\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-15.png 490w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/09\/image-15-300x127.png 300w\" sizes=\"auto, (max-width: 490px) 100vw, 490px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"682\" height=\"625\" src=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/12\/image-25.png\" alt=\"\" class=\"wp-image-244\" srcset=\"https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/12\/image-25.png 682w, https:\/\/thecyberstaff.com\/wp-content\/uploads\/2025\/12\/image-25-300x275.png 300w\" sizes=\"auto, (max-width: 682px) 100vw, 682px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This box took a ton of troubleshooting and resets for the privilege escalation. The web server kept crashing but after many attempts, I finally got it finished. I start things off with a port scan for all 65,535 TCP ports and the top UDP ports. I ended digging into port [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":244,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-pentesting"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=243"}],"version-history":[{"count":2,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/243\/revisions"}],"predecessor-version":[{"id":347,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/posts\/243\/revisions\/347"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=\/wp\/v2\/media\/244"}],"wp:attachment":[{"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecyberstaff.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}