<h1>Metasploitable 3 Windows Walkthrough: Part VIII</h1>

Exploiting Port 5985 – Windows Remote Management

Windows Remote Management (WinRM) is the Microsoft implementation of WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and operating systems, from different vendors, to interoperate.

Accessing Port 5985

Load the proper Metasploit module and use the existing credentials:

Exploiting Port 5985

Executing remote commands is easy with the appropriate module.

Create a new user, maybe to use as a persistence technique:

But a meterpreter shell is also easy to get:

Exploiting Port 8020 – Desktop Manage Engine

ManageEngine offers enterprise IT management software for your service management, operations management, Active Directory and security needs.

Accessing Desktop Manage Engine

When you browse this port, you will see the entry page of the service waiting for login credentials:

Try to brute force your access with Metasploit:

Using these credentials, you can now enter the Desktop Central 9 Administration page:

From here it should be easy to turn this new access level in a shell on the target machine. To turn regular functionality into a shell you should be looking out for functionality to upload files, install plugin’s, edit system files and anything else that allows you to execute code or commands on the target system.

NOTE: The administration page can be accessed over the HTTP port 8020 and the HTTPS port 8383

Exploiting Desktop Manage Engine

This service can also be exploited using a proper Metasploit module: