Markup
Personal Rating: Very Easy
Enumeration
A first nmap scan revealed a webserver on the Windows machine:
sudo nmap -sC -sV <IP>
XXE Exploit
Visiting that Server, it was to be discovered that XML formatted user input was sent to the server. I tried a simple test XXE and it worked directly:
The loaded external entity had to be in the "item" field and the path delimiter had to be a '/' despite the machine running Windows.
Persistence
Using the XXE I could obtain the private ssh key of the user and ssh onto the machine.
Last updated