Kevin Proving Grounds Write-Up

SUMMARY

This write-up covers the Kevin machine from Offsec’s Proving Grounds, a Windows machine where a management interface exposed via HTTP led directly to Administrator access.

Port 80 exposed an HP Power Manager login panel. The application accepted default credentials (admin:admin), granting access to the dashboard. A known buffer overflow exploit was found for the identified version on Exploit-DB. Reviewing the script revealed it used a hardcoded msfvenom payload, which was replaced with a fresh one generated for the attacker’s IP and port. Executing the modified script triggered the overflow and returned a shell as Administrator.

---

PATH TO FOLLOW

1. Reconnaissance & HP Power Manager Discovery on Port 80
2. Default Credential Login
3. Buffer Overflow Exploit Identification
4. Custom msfvenom Payload Generation
5. Exploit Execution & Shell as Administrator

Due to OffSec’s policy on content sharing, these write-ups will provide hints only rather than full solutions.I know, boring stuff.