dreadnaught- Machine
- Omni
- OS
- Windows
- Difficulty
- Easy
- Steps
- 3
- Added
- 23 Mar 2023
SirepRAT gives command execution on a Windows IoT Core device; leaked credentials decrypt the credential-protected flags.
How it went
- 0nmap
An nmap scan shows a Windows Device Portal on port 8080 (IoT Core).
- 1Device Portal
SirepRAT exploits the device portal for command execution on the box.
- 2app creds
A r.bat script leaks the app and Administrator credentials; as app, that decrypts the CliXml-protected user flag.
- 3administrator
Logging into the portal as Administrator decrypts the root flag the same way.