Skills Assigment - Pivoting, Tunneling, and Port Forwarding

1

I’m stuck in this quetion:
For your next hop enumerate the networks and then utilize a common remote access solution to pivot. Submit the C:\Flag.txt located on the workstation.

I already found the windows server, but i can find the others computers into the network.

Someone can help me? I’m stuck here about 3 days

2 Likes
2

Have you tried Ping sweep?

3

That is what i did:

  1. Connected to webadmin server using a ssh -D 9050
  2. RDP to windows server using proxychains (172.16.5.35)
  3. Used a “for script”: for /L %i in (1,1,255) do @ping -n 1 -w 200 172.16.5.%i > nul && echo 172.16.5.%i is up.
  4. Found only 172.16.5.15(ubuntu), 172.16.5.35(windows)
  5. Nmap -sn to 172.16.5.1 with proxychains
  6. Found only 172.16.5.15(ubuntu), 172.16.5.35(windows) again
  7. Stuck here
1 Like
5

Are you still stuck?
I think I found an other ip but I can’t connect

6

i already done

1 Like
7

use ipconfig, you will see 2 ethernet networks, 1 is one network, 2 is the other.
Use this command to do a ping sweep in CMD (not powershell):

for /L %i in (1,1,255) do @ping -n 1 -w 172.16.5.%i > nul && echo 172.16.5.%i is up.

Change 172.16.5. to ip that you found and you will found the next machine

8

Yes I did, found a 172.16.6.**, but can’t connect. I tried a double port forwarding (with netsh) to connect via rdp but no result

9

You need to use netsh in windows machine

10

I did, I use netsh in the first windows machine to connect port 3389 of second machine and set a portfwd in the ubuntu server. But when i try xfreerdp it doesn’t work.
I use same credentials, like the note said.

12

Hey, what creds did you use for the last machine? The same as in the note on ssh?

13

user: vfrank , pass: Imply wet Unmasked

tip: use mimikatz to get passwords

14

I ve already done it, Thanks

15

hey,
in the first place how did you crack that password?
secondly that password does not match the nt hash i got of vfrank.

I did lsass dump and got the hashes but I’m not able to crack it :frowning:.

I’ve found the 3rd host but I can’t access it.

If someone could help :slight_smile:

16

nvm, figured it out!
:))

18

Did you figure this out. I’m working on it right now.

19

I’m at the same point. Did you finish the skills assessment?

[UPDATE]

I finished the module.

2 Likes
20

hello colleague, am in at a similar stage, after the ping sweep,discovered the 172.16.6.35 but cannot find the credentials for vfrank and so cannot login to it. :melting_face:any help would be appreciated. Zhanna

21

The last machine is 172.16.6.25 I believe.

23

use mimikatz

24

Maybe you accidentally answered my question, i was on vfrank and couldn’t find the last two flags. But my vfrank was on 172.16.6.35 ,not the 25 one. And couldn’t find any new flags except for the previous one, the one you see on mlefay. Am badly stuck

1 Like