Host & Network Penetration Testing: System-Host Based Attacks CTF 1

In this lab environment, you will be provided with GUI access to a Kali Linux machine. Two machines are accessible at http://target1.ine.local and http://target2.ine.local.

Objective: Perform system/host-based attacks on the target and capture all the flags hidden within the environment.

Useful files:

/usr/share/metasploit-framework/data/wordlists/common_users.txt, 
/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt,
/usr/share/webshells/asp/webshell.asp

Flags to Capture:

  • Flag 1: User 'bob' might not have chosen a strong password. Try common passwords to gain access to the server where the flag is located. (target1.ine.local)

  • Flag 2: Valuable files are often on the C: drive. Explore it thoroughly. (target1.ine.local)

  • Flag 3: By attempting to guess SMB user credentials, you may uncover important information that could lead you to the next flag. (target2.ine.local)

  • Flag 4: The Desktop directory might have what you're looking for. Enumerate its contents. (target2.ine.local)

Scanning 1st Machine

┌──(root㉿INE)-[~]
└─# nmap -sC -sV -script vuln target1.ine.local
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-11 18:51 IST
Nmap scan report for target1.ine.local (10.5.25.223)
Host is up (0.0017s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-server-header: Microsoft-IIS/10.0
|_http-csrf: Couldn't find any CSRF vulnerabilities.
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_smb-vuln-ms10-054: false
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 149.84 seconds

Let us browse the website and we have some kind of login credentials

Bruteforce HTTP

let us bruteforce the credentials as we do have a hint to do that.

Now, we can perform a brute-force attack to gather more details about our target system. The command to use is: dirb http://target1.ine.local -u bob:password_123321

Exploiting Webdav

After completing the directory fuzzing, we discovered that /webdav is running on the host.

Let’s navigate to that directory, and we found our first flag there which is:

From the flag above, we can clearly see that there is a file named test.asp, which indicates that the server accepts .asp file extensions for upload. We can also enumerate this through davtest. davtest is a command used to enumerate the file extensions that can be uploaded to WebDAV.

Having determined that we can upload various file types such as .asp, .txt, .shtml, and .html to the server, we will upload the .asp file to gain access to the shell.

To achieve this, we can use the cadaver tool to upload the file. The command will be

We will then upload the .asp file using the following command:

We will then open the browser and navigate to /webdav/webshell.asp

As observed, we now have access to our shell. According to the question, valuable files are located on the C drive. Let’s list the contents of the C drive using the following command: dir C:\

And here, we have obtained our second flag. To read the contents of flag2.txt, use the following command:

Scanning 2nd Machine

Enumerating SMB

Let us enumerate SMB first

However, we couldn’t find anything using enum4linux, as the server doesn’t allow it.

Since we don’t know the username and password, we need to enumerate both. While we can also use the Metasploit framework for this, I’m opting for the hydra tool for faster output.

After performing the brute-force attack, we discovered various usernames and passwords. Let’s proceed with the administrator credentials.

To connect to the SMB share for the administrator user, use the following command:

You will be prompted for the password. Enter the administrator password.

The administrator has 6 shares. Before accessing any of the shares, let’s check the permissions of each one. To do this, we’ll use the crackmapexec tool.

After running the command, we discover that only two shares have read and write permissions: ADMIN$ and C$ .

Since C$ is the default share, let’s explore the contents of the C$ share. The command will be:

Finally, for the last flag, the question mentions that we need to enumerate the Desktop directory. Let’s navigate to that directory using the following command:cd Users\Administrator\Desktop\

After that, run the dir command to list all the contents.

Here, we find our last flag.

PreviousINENextHost & Network Penetration Testing: System-Host Based Attacks CTF 2 - INE

Last updated