Compromised_Web_443

Web

---

Nmap discovered a Web server on the port 443 of the 192.168.225.152 host. The running service is Microsoft IIS httpd 10.0

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/compromised]
└─$ curl -k -I -X OPTIONS https://$IP/
HTTP/2 200 
allow: OPTIONS, TRACE, GET, HEAD, POST
server: Microsoft-IIS/10.0
public: OPTIONS, TRACE, GET, HEAD, POST
x-powered-by: ASP.NET
date: Sat, 28 Jun 2025 18:16:07 GMT
content-length: 0
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/compromised]
└─$ curl -k -I https://$IP/        
HTTP/2 200 
content-length: 703
content-type: text/html
last-modified: Tue, 01 Jun 2021 14:59:09 GMT
accept-ranges: bytes
etag: "3c7a34adf656d71:0"
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Sat, 28 Jun 2025 18:16:10 GMT

Webroot It’s the default IIS installation page.

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/compromised]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt  -u https://$IP/FUZZ -ic -e .html,.txt,.aspx
________________________________________________
 :: Method           : GET
 :: URL              : https://192.168.225.152/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .aspx 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
aspnet_client           [Status: 301, Size: 161, Words: 9, Lines: 2, Duration: 26ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1851 req/sec :: Duration: [0:01:15] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/compromised]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u https://$IP/FUZZ/ -ic
________________________________________________
 :: Method           : GET
 :: URL              : https://192.168.225.152/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 703, Words: 27, Lines: 32, Duration: 19ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1739 req/sec :: Duration: [0:03:37] :: Errors: 120 ::

N/A

PSWA

---

As hinted from a PowerShell script found in the target SMB server, there might be a PSWA endpoint available on the web server.

PSWA endpoint identified.