Kevin - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed HTTP, SMB and some common windows ports were open. Moreover, it revealed that target was vulnerable to Eternal Blue.
However, because target was x86 the MS17_010 exploit did not work.
Web Enumeration
So I checked the website and found it was HP Power Manager website.
The credentials were left default so I simply logged in with admin:admin credentials.
Then I checked the Help tab and found out it was HP Power Manager 4.2 (Build 7)
Exploitation (Directly SYSTEM)
CVE-2009-3999
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter.
The target was vulnerable to RCE. So I simply used msfconsole module named exploit/windows/http/hp_power_manager_filename and obtained SYSTEM Shell.